Need Support for Redis Ticket Registry in CAS 7.2.4

[Prakash Thapa]

I am trying to integrate Redis Ticket Registry for CAS 7.2.4. And I ran into following error while running my CAS

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'redisModulesOperations' defined in class path resource [org/apereo/cas/config/CasRedisTicketRegistryAutoConfiguration$RedisTicketRegistryModulesConfiguration.class]: Failed to instantiate [org.apereo.cas.redis.core.RedisModulesOperations]: Factory method 'redisModulesOperations' threw exception with message: Redis server does not support Redis Modules

The issue seem to arise from following block of code of class 'CasRedisTicketRegistryAutoConfiguration':

val operations = redisModulesOperations.stream().filter(BeanSupplier::isNotProxy).findFirst();
return new RedisTicketRegistry(cipher, ticketSerializationManager, ticketCatalog, applicationContext,
casRedisTemplates, redisTicketRegistryCache, redisTicketRegistryMessagePublisher,
operations, redisKeyGeneratorFactory, adapter, casProperties);

The config is:

cas:
ticket:
registry:
redis:
# Redis server host
host: "localhost"
port: 6379
password: "your-redis-password"
database: 0
enabled: true
crypto:
enabled: true
encryption:
key: "YourEncryptionKeyMustBeAtLeast256Bits"
signing:
key: "YourSigningKeyMustBeAtLeast256Bits"

I have added following dependencies:

implementation("org.apereo.cas:cas-server-support-redis-ticket-registry:${project.'cas.version'}")
implementation("org.apereo.cas:cas-server-support-redis-modules:${project.'cas.version'}")

[Olivier]

Hi Prakash,

I had the same issue when upgrading CAS from 6.6 to 7.3 with AWS Elasticache Redis.

This has been solved by adding the following property: cas.ticket.registry.redis.enable-redis-search=false

I’m not sure if there is a better solution but it worked for me, although I have not performed any performance test yet, so, I’m not yet sure if there will be any performance impact.

Thanks.
Olivier Begon.

Florida State University.

[Wes Conley]

It may be that your redis server doesn't support redis search. I'm successfully using redis-stack-server:7.2.0-v18 (https://hub.docker.com/r/redis/redis-stack-server) with cas.ticket.registry.redis.enable-redis-search=true. In my redis.conf I load the redis search library.

loadmodule /opt/redis-stack/lib/redisearch.so.

[Prakash Thapa]

Thank You all for responses.

Olivier,
Turning off the redis-search worked fine for me as well and I have used same configuration. However, this might not be a actual solution.


Wes,
I am not sure whether it is compatibility issue. I tried with local Redis and the AWS Elasticache. The issue seems to be on build/beans initialization itself rather than while making connection.

[Frédéric Dussurget]

Hi Prakash,
I went a little further, below here is what I've done. My context is redis + redis sentinel nodes.

First, I did a dist upgrade from debian 11 to 12
Having read Wes comment, I used the Following apt source list to upgrade redis from 6.x to 7.4.0-v8 (have a look with "apt policy redis"):
 deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb bullseye main (yes I know it is bullseye on a bookworm …)

I replaced distrib packages redis-server and redis-sentinel to redis-stack-server which handles redis server and sentinel. I created new services using old /etc/redis/redis.conf and /etc/redis/sentinel.conf with the same binary /opt/redis-stack/bin/redis-stack-server.

I updated /etc/redis/redis.conf with the new redisearch module path, as said Wes :
loadmodule /opt/redis-stack/lib/redisearch.so

Then I eventually stopped and disabled the old ones then enabled and activated the new ones

this done, the bundled redisearch module changed from v1.2.0 (redisearch.so from deb 11 distrib) to to v2.xx  :

127.0.0.1:6379> MODULE LIST
1) 1) "name"
   2) "search"
   3) "ver"
   4) (integer) 21020
   5) "path"
   6) "/opt/redis-stack/lib/redisearch.so"
   7) "args"
   8) (empty array)

For info, with redis packages from debian 11 I had this redisearch version :
4) (integer) 10200


Then I edit acl on my user on every nodes and thru sentinel connecting on port 26379, I Added the &* so that my user can subscribe to the "channels" pub/sub :
127.0.0.1:6379>ACL SETUSER myuser on nopass ~* &* +@all
127.0.0.1:6379> acl list
1) "user myuser on sanitize-payload #a9a9a9a9b8b8b8b8c7c7c7blahblah ~* &* +@all"

I finally turned redis.enable-redis-search to true and … it's finally working.

But I've got a new issue : this parameter does not look to support sentinel : when I stop my redis server service on node 1, redisearch looks for localhost and does not use sentinel backup on the other nodes, in the logs I have : Caused by: io.netty.channel.AbstractChannel$AnnotatedConnectException: finishConnect(..) failed: Connection refused: localhost/127.0.0.1:6379 and cas won't start if I restart the tomcat service.
When my redis-stack-service is stopped on node 1 and redis.enable-redis-search set to false, sentinel works perfectly and cas talks to redis servers running on the other nodes. So, for now, I cannot set this parameter to "true".

If you do not use sentinel, this might be ok for you ...

I might have forgotten Something somewhere … ? Is it worth giving a try on debian 13 trixie with redis 8+ ?

To Wes, are you using sentinel nodes ?

Regards,

[Wes Conley]

Yes, here's my sentinel config. I've confirmed the ticket registry remains functional when the master node changes (in this case 1.2.3.4 goes down). I have not tested what happens when the master node is different than 1.2.3.4 on startup, but generally speaking 1.2.3.4 remains master.

cas.ticket.registry.redis.host="1.2.3.4"
cas.ticket.registry.redis.password="redacted"
cas.ticket.registry.redis.port="6380"

cas.ticket.registry.redis.sentinel.master="redis-casdev"
cas.ticket.registry.redis.sentinel.node[0]="1.2.3.5:26380"
cas.ticket.registry.redis.sentinel.node[1]="1.2.3.4:26380"
cas.ticket.registry.redis.sentinel.node[2]="1.2.3.6:26380"

[Frédéric Dussurget]

Hi Wes, thank you for your response. In my case also,  when the cas webapp is running, the ticket registry remains functional. But if redis-stack-server is down on one node, I cannot restart cas on this node (tomcat webapp in my case), it just crashes ... because it's trying to reach redis only on this node. Could you test to reproduce this behavior sometime on your side ? 

(With  redis.enable-redis-search= false, in the exact same context, the webapp is able to restart)

Many thanks !