redis-cloud-auth 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b9f70dde3145f339c34f39691b3dfd41c8e10b9f9168686291ae2eff33f03911
+  data.tar.gz: ce98ed3815f8a8874b33464273b8c65af7c696c4a7822a2397144fe509f21f97
+SHA512:
+  metadata.gz: b7824bce2e067f56cba7b05015c2f09749b1e4c019f46ae243fb4a2a4635082b981f8a230cc2785a27645d3de413b76e5390ad7059a7b83f43a78ff3cfd8cc4f
+  data.tar.gz: '09e1726c98e063ee9ebf1e2bd86fa5b5c2ba0b2570f2315ecceff72a20d44e2a7014606cda7e51bedae2dd6141ad9767ce1428a51da6a5f07219af99f33aa4f1'

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GitLab B.V.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,119 @@
+# redis-cloud-auth
+
+Authenticate Redis connections with short-lived **cloud identity** tokens
+instead of a static password, from any `redis-client` / `redis-rb` / Sidekiq
+application.
+
+Managed Redis services increasingly support token-based authentication tied to a
+cloud IAM identity:
+
+- **Azure** Managed Redis / Azure Cache for Redis, with Microsoft Entra
+- **AWS** ElastiCache, with IAM authentication
+- **Google Cloud** Memorystore for Redis Cluster / Valkey, with IAM
+
+In each case the Redis `AUTH` password is a short-lived token minted for a
+workload identity (for example via Kubernetes Workload Identity), not a secret
+you store. `redis-cloud-auth` fetches those tokens, uses them to authenticate
+new connections, and transparently re-authenticates long-lived connections
+before the token expires, so you can point a normal Redis client at a managed,
+token-only Redis with a couple of config lines.
+
+## Install
+
+```ruby
+gem "redis-cloud-auth"
+```
+
+Then add the backend gem for the provider(s) you use (they are loaded lazily and
+are not hard dependencies):
+
+- `:azure` → `az-identity`
+- `:aws` ElastiCache → `aws-sigv4`
+- `:gcp` → `googleauth`
+
+## Usage
+
+```ruby
+require "redis-client"
+require "redis_cloud_auth"
+
+RedisCloudAuth.register!            # once at boot (registers the middleware)
+RedisCloudAuth.logger = my_logger   # optional; logs re-auth failures
+
+descriptor = { provider: :azure, resource: "https://redis.azure.com" }
+
+config = RedisClient.config(
+  host: "cache.example.com",
+  port: 10000,
+  ssl: true,                                            # token auth requires TLS
+  username: "<identity-id>",
+  password: RedisCloudAuth.credential(descriptor),      # token at connect time
+  custom: { credentials_provider: descriptor }          # enables re-auth middleware
+)
+
+config.new_client.call("PING")
+```
+
+The **descriptor** is a plain Hash of simple values, so the whole Redis config
+stays marshallable (important for Sidekiq, which `Marshal`s its config). The same
+descriptor goes in both `password` (via `credential`) and
+`custom[:credentials_provider]` (for the middleware).
+
+Works the same with `redis-rb` 5+ (which is built on `redis-client`) and Sidekiq
+7+.
+
+## How it works
+
+Two small pieces wire a provider into a connection:
+
+- **`RedisCloudAuth.credential(descriptor)`** returns a marshallable callable
+  used as the `password`. `redis-client` invokes it on every (re)connect, so
+  each new connection authenticates with a current token. It holds only the
+  descriptor and resolves the live provider at call time, so it survives
+  `Marshal` round-trips.
+- **The re-auth middleware** (`RedisCloudAuth.register!`) re-issues `AUTH` on a
+  live connection shortly before its token expires, tracking expiry per
+  connection and understanding RESP3 `HELLO ... AUTH` preludes. It is a no-op on
+  connections without a `credentials_provider` descriptor.
+
+A **provider** is the only cloud-specific part. It is a tiny duck type:
+
+```ruby
+provider.call        # => [username, password]   (fresh token each call)
+provider.expires_at  # => Time, or nil before the first token is fetched
+```
+
+## Built-in providers
+
+| `:provider` | Service | Backend gem | Key descriptor options |
+|---|---|---|---|
+| `:azure` | Azure Managed Redis / Entra | `az-identity` | `:username`, `:resource`, `:environment` |
+| `:elasticache` | AWS ElastiCache IAM | `aws-sigv4` | `:user_id`, `:cache_name`, `:region`, `:credentials` |
+| `:gcp` | GCP Memorystore IAM | `googleauth` | `:username`, `:scope`, `:credentials` |
+
+Providers fetch tokens from the ambient workload identity by default (Azure
+Workload Identity, AWS IRSA/Pod Identity, GKE Workload Identity, or the instance
+metadata server), so no key material lives in the descriptor.
+
+> All three providers are verified against a live managed Redis: Entra on Azure
+> Managed Redis, IAM on GCP Memorystore for Redis Cluster, and IAM on AWS
+> ElastiCache Serverless.
+>
+> The `:elasticache` provider signs the token with `AWS_ACCESS_KEY_ID` /
+> `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` from the environment, or with a
+> `:credentials` object you pass in the descriptor. On EC2/EKS, point it at the
+> instance/pod role credentials (for example via the AWS SDK credential chain).
+
+## Custom providers
+
+Register any object that responds to `#call` and `#expires_at`:
+
+```ruby
+RedisCloudAuth::Registry.register_provider(:myprovider) do |descriptor|
+  MyProvider.new(descriptor)
+end
+```
+
+## License
+
+MIT.

data/lib/redis_cloud_auth/providers/azure.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  module Providers
+    # Microsoft Entra provider. Thin adapter over the `az-identity` gem, which
+    # already implements the provider interface (#call => [username, token],
+    # #expires_at). The username defaults to the managed identity / service
+    # principal object (principal) ID from the token's +oid+ claim.
+    #
+    # Descriptor keys: :username (optional), :resource (for example
+    # "https://redis.azure.com"), :environment (optional Azure cloud).
+    module Azure
+      def self.build(descriptor)
+        # Lazily required so az-identity is only pulled in when Azure is used.
+        require "az_identity"
+
+        AzIdentity::RedisCloudAuth.new(
+          username: descriptor[:username],
+          resource: descriptor[:resource],
+          environment: descriptor[:environment]
+        )
+      end
+    end
+  end
+end

data/lib/redis_cloud_auth/providers/elasticache.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  module Providers
+    # Amazon ElastiCache IAM provider. Verified live against ElastiCache
+    # Serverless (IAM auth + TLS).
+    #
+    # ElastiCache IAM authentication uses a short-lived "auth token" that is a
+    # SigV4-presigned GET URL (service "elasticache") with Action=connect and
+    # User=<user-id>, valid ~15 minutes. The token sent as the Redis password is
+    # that presigned URL with the scheme stripped; the Redis AUTH username is the
+    # ElastiCache user id.
+    #
+    # Descriptor keys:
+    #   :user_id     ElastiCache IAM-enabled user (also the Redis AUTH username)
+    #   :cache_name  replication group / cluster id (the presign host label)
+    #   :region      AWS region
+    #   :credentials optional object with #access_key_id/#secret_access_key/
+    #                #session_token; defaults to the standard AWS env vars
+    #
+    # Implements the same interface as the Azure provider:
+    #   #call => [username, token]   #expires_at => Time
+    class ElastiCache
+      TOKEN_TTL = 900 # seconds; ElastiCache IAM tokens are valid for 15 minutes.
+      REFRESH_MARGIN = 60
+
+      def self.build(descriptor)
+        new(descriptor)
+      end
+
+      def initialize(descriptor)
+        @user_id = descriptor.fetch(:user_id)
+        @cache_name = descriptor.fetch(:cache_name)
+        @region = descriptor.fetch(:region)
+        @credentials = descriptor[:credentials]
+        @mutex = Mutex.new
+      end
+
+      def call
+        @mutex.synchronize do
+          generate! if @token.nil? || @expires_at.nil? || (@expires_at - REFRESH_MARGIN) <= Time.now
+          [@user_id, @token]
+        end
+      end
+
+      def expires_at
+        @mutex.synchronize { @expires_at }
+      end
+
+      private
+
+      def generate!
+        require "aws-sigv4"
+        require "cgi"
+
+        signer = Aws::Sigv4::Signer.new(
+          service: "elasticache",
+          region: @region,
+          credentials: aws_credentials
+        )
+
+        url = signer.presign_url(
+          http_method: "GET",
+          url: "https://#{@cache_name}/?Action=connect&User=#{CGI.escape(@user_id)}",
+          body: "",
+          expires_in: TOKEN_TTL
+        ).to_s
+
+        @token = url.sub(%r{\Ahttps?://}, "")
+        @expires_at = Time.now + TOKEN_TTL
+      end
+
+      def aws_credentials
+        return @credentials if @credentials
+
+        Aws::Sigv4::Credentials.new(
+          access_key_id: ENV.fetch("AWS_ACCESS_KEY_ID"),
+          secret_access_key: ENV.fetch("AWS_SECRET_ACCESS_KEY"),
+          session_token: ENV.fetch("AWS_SESSION_TOKEN", nil)
+        )
+      end
+    end
+  end
+end

data/lib/redis_cloud_auth/providers/gcp.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  module Providers
+    # Google Cloud provider for Memorystore for Redis Cluster / Valkey IAM
+    # authentication. The Redis password is a Google OAuth2 access token; the
+    # identity needs the `roles/redis.dbConnectionUser` role.
+    #
+    # Uses Application Default Credentials (the `googleauth` gem), so it picks up
+    # GKE Workload Identity, the GCE/GKE metadata server, or a service-account
+    # key automatically, with no key material in the descriptor.
+    #
+    # Descriptor keys:
+    #   :username    Redis AUTH username (defaults to "default"; Memorystore
+    #                verifies the token and ignores the username, confirmed live:
+    #                token-only, "default", and the SA email all authenticate)
+    #   :scope       OAuth scope(s) (defaults to cloud-platform)
+    #   :credentials optional prebuilt googleauth/Signet credentials object
+    #
+    # Implements the common interface: #call => [username, token],
+    # #expires_at => Time.
+    #
+    # NOTE: Memorystore keeps an already-authenticated connection alive even
+    # after its token expires, so for GCP the connect-time token (TokenCredential)
+    # is the load-bearing part; the re-auth middleware is harmless but less
+    # critical than on providers that drop the connection at expiry.
+    class GCP
+      DEFAULT_SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+      DEFAULT_USERNAME = "default"
+      REFRESH_MARGIN = 60
+
+      def self.build(descriptor)
+        new(descriptor)
+      end
+
+      def initialize(descriptor)
+        @username = descriptor[:username] || DEFAULT_USERNAME
+        @scope = descriptor[:scope] || DEFAULT_SCOPE
+        @credentials = descriptor[:credentials]
+        @mutex = Mutex.new
+      end
+
+      def call
+        @mutex.synchronize do
+          creds = credentials
+          creds.fetch_access_token! if creds.access_token.nil? || creds.expires_within?(REFRESH_MARGIN)
+          [@username, creds.access_token]
+        end
+      end
+
+      def expires_at
+        @mutex.synchronize { @credentials&.expires_at }
+      end
+
+      private
+
+      def credentials
+        @credentials ||= begin
+          require "googleauth"
+          Google::Auth.get_application_default(Array(@scope))
+        end
+      end
+    end
+  end
+end

data/lib/redis_cloud_auth/reauth_middleware.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  # redis-client middleware that proactively re-issues AUTH on a live connection
+  # shortly before a rotating access token expires, so pooled connections are
+  # refreshed before the server rejects a command. Connect-time authentication
+  # is handled by the callable password ({TokenCredential}); this only covers
+  # already-established, long-lived connections.
+  #
+  # The provider caches a single token process-wide and advances its
+  # `expires_at` whenever any connection triggers a refresh. Each pooled
+  # connection, however, stays authenticated with whatever token it last sent
+  # AUTH with. We therefore track expiry per connection (redis-client builds one
+  # middleware instance per connection) rather than reading the shared provider
+  # expiry, so a connection still holding the old token re-auths instead of
+  # being skipped because another connection already refreshed.
+  #
+  # Register globally via RedisClient.register (see
+  # RedisCloudAuth.register!). It is a no-op unless a credentials
+  # provider descriptor is present in the connection's `custom` config under
+  # :credentials_provider.
+  module ReauthMiddleware
+    # Re-authenticate at least this many seconds before the token expires.
+    # Microsoft recommends sending the new token at least 3 minutes early.
+    REAUTHENTICATION_LEEWAY = 180.0
+    # Extra random lead time (0..this) added per connection so pooled
+    # connections do not all re-authenticate at the same instant.
+    REAUTHENTICATION_JITTER = 30.0
+
+    def call(command, config)
+      # Skip when we are issuing our own AUTH below, to avoid recursing.
+      reauthenticate(config) unless auth_command?(command)
+      super
+    end
+
+    def call_pipelined(commands, config)
+      # The connection prelude authenticates itself via the password; when an
+      # AUTH is already part of the pipeline, skip re-auth and instead record
+      # the expiry of the token this connection just authenticated with.
+      if commands.any? { |command| auth_command?(command) }
+        result = super
+        track_token_expiry(config)
+        result
+      else
+        reauthenticate(config)
+        super
+      end
+    end
+
+    private
+
+    def auth_command?(command)
+      name = command.first.to_s
+      return true if name.casecmp?("AUTH")
+
+      # RESP3 connections (for example Sidekiq 7) authenticate in the prelude as
+      # `HELLO 3 AUTH <user> <token>`, so treat that as an AUTH too.
+      name.casecmp?("HELLO") && command.any? { |arg| arg.to_s.casecmp?("AUTH") }
+    end
+
+    # Per-connection lead time, fixed once so this connection re-authenticates
+    # at a stable, slightly randomized point before expiry.
+    def reauthentication_leeway
+      @reauthentication_leeway ||= REAUTHENTICATION_LEEWAY + (rand * REAUTHENTICATION_JITTER)
+    end
+
+    def reauthenticate(config)
+      descriptor = config.custom && config.custom[:credentials_provider]
+      return unless descriptor
+
+      provider = Registry.fetch(descriptor)
+
+      # Decide from the expiry of the token THIS connection last authed with,
+      # falling back to the provider's current expiry before the first AUTH is
+      # observed. A provider that exposes no expiry can't tell us when to
+      # refresh, so leave that to the reconnect path.
+      expires_at = @token_expires_at || provider.expires_at
+      return unless expires_at
+      return if (expires_at - reauthentication_leeway) > Time.now
+
+      token = provider.call.last
+      return unless token
+
+      client.call("AUTH", config.username, token)
+      @token_expires_at = provider.expires_at
+    rescue StandardError => e
+      # A transient token-refresh (or AUTH) failure inside the leeway window
+      # must not fail the command: the current token is still valid until
+      # expiry, so log and let the operation proceed on the existing creds.
+      log_reauthentication_failure(e)
+    end
+
+    # Log at most once per leeway window per connection. A sustained token
+    # endpoint outage would otherwise re-enter this path and log on every Redis
+    # command until the token actually expires.
+    def log_reauthentication_failure(error)
+      now = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+      return if @last_failure_log_at && (now - @last_failure_log_at) < REAUTHENTICATION_LEEWAY
+
+      @last_failure_log_at = now
+      RedisCloudAuth.logger&.warn("Redis token re-authentication failed: #{error.message}")
+    end
+
+    # Remember the expiry of the token this connection authenticated with during
+    # the prelude, so subsequent re-auth decisions track this connection rather
+    # than the process-shared provider expiry.
+    def track_token_expiry(config)
+      descriptor = config.custom && config.custom[:credentials_provider]
+      return unless descriptor
+
+      @token_expires_at = Registry.fetch(descriptor).expires_at
+    end
+  end
+end

data/lib/redis_cloud_auth/registry.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  # Process-global registry of providers, keyed by a marshallable descriptor
+  # (a Hash of simple values). Providers are memoized so every pooled
+  # connection and thread shares one provider, which caches the access token
+  # and refreshes it as needed.
+  #
+  # The indirection through a descriptor is deliberate: the descriptor (not the
+  # live provider) is embedded in the Redis config, so the config stays
+  # marshallable when Sidekiq round-trips it through Marshal.dump/load. The
+  # provider itself (holds tokens, does I/O) is resolved here at runtime and
+  # never serialized.
+  #
+  # Built-in providers: +:azure+ (Microsoft Entra, via the az-identity gem),
+  # +:elasticache+ (Amazon ElastiCache IAM, via aws-sigv4), and +:gcp+ (Google
+  # Memorystore IAM, via googleauth). Register more with {register_provider}.
+  module Registry
+    MUTEX = Mutex.new
+
+    @providers = {}   # descriptor => live provider
+    @builders  = {}   # provider name (Symbol) => ->(descriptor) { provider }
+
+    class << self
+      # Returns the memoized provider for +descriptor+, building it on first
+      # use. The middleware calls this on every command on a token-authed
+      # connection, so the cache-hit path is lock-free; only the first build
+      # per descriptor takes the mutex.
+      def fetch(descriptor)
+        @providers[descriptor] || MUTEX.synchronize { @providers[descriptor] ||= build(descriptor) }
+      end
+
+      # Register a builder for a provider name. The block receives the
+      # descriptor Hash and must return an object responding to #call
+      # (=> [username, password]) and #expires_at (=> Time or nil).
+      def register_provider(name, &builder)
+        MUTEX.synchronize { @builders[name.to_sym] = builder }
+      end
+
+      # Inject a prebuilt provider for a descriptor. Intended for tests.
+      def store(descriptor, provider)
+        MUTEX.synchronize { @providers[descriptor] = provider }
+      end
+
+      def clear!
+        MUTEX.synchronize { @providers = {} }
+      end
+
+      private
+
+      def build(descriptor)
+        name = descriptor[:provider].to_s.to_sym
+        builder = @builders[name] || default_builder(name)
+        raise Error, "unknown Redis credentials provider: #{descriptor[:provider].inspect}" unless builder
+
+        builder.call(descriptor)
+      end
+
+      # Built-in providers are required lazily so their (optional) backing gems
+      # are only loaded when actually used.
+      def default_builder(name)
+        case name
+        when :azure
+          lambda do |descriptor|
+            require_relative "providers/azure"
+            Providers::Azure.build(descriptor)
+          end
+        when :elasticache
+          lambda do |descriptor|
+            require_relative "providers/elasticache"
+            Providers::ElastiCache.build(descriptor)
+          end
+        when :gcp
+          lambda do |descriptor|
+            require_relative "providers/gcp"
+            Providers::GCP.build(descriptor)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/redis_cloud_auth/token_credential.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  # A marshallable callable used as the redis-client `password`. redis-client
+  # invokes `#call(username)` on every (re)connect, so returning a fresh access
+  # token here authenticates new connections with a current token.
+  #
+  # It holds only the descriptor (simple values) and resolves the shared
+  # provider from {Registry} at call time, so it can be Marshal.dump'd by
+  # Sidekiq (unlike a Proc or a live provider object).
+  class TokenCredential
+    def initialize(descriptor)
+      @descriptor = descriptor
+    end
+
+    def call(_username = nil)
+      Registry.fetch(@descriptor).call.last
+    rescue StandardError => e
+      # redis-client only retries its own connection errors, and failsafes
+      # (for example RedisCacheStore) only rescue RedisClient::Error. Map a
+      # token-fetch failure to a connection error so a transient token-endpoint
+      # outage is retried/handled as a reconnect rather than surfacing as a 500.
+      # The original error is kept as the cause.
+      require "redis-client"
+      raise RedisClient::CannotConnectError, "failed to acquire Redis token: #{e.message}"
+    end
+  end
+end

data/lib/redis_cloud_auth/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module RedisCloudAuth
+  VERSION = "0.1.0"
+end

data/lib/redis_cloud_auth.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "logger"
+
+require_relative "redis_cloud_auth/version"
+require_relative "redis_cloud_auth/registry"
+require_relative "redis_cloud_auth/token_credential"
+require_relative "redis_cloud_auth/reauth_middleware"
+
+# Rotating-token ("credentials provider") authentication for Redis, usable from
+# any redis-client / redis-rb / Sidekiq consumer.
+#
+# A *provider* turns a cloud identity (Microsoft Entra, Amazon ElastiCache IAM,
+# ...) into short-lived Redis credentials. It is a simple duck type:
+#
+#   provider.call        # => [username, password]  (fresh each call)
+#   provider.expires_at  # => Time, or nil when no token has been fetched yet
+#
+# Two pieces wire a provider into a connection:
+#
+# * {TokenCredential} is a marshallable callable used as the redis-client
+#   `password`. It authenticates every (re)connect with a current token and
+#   survives Marshal round-trips (Sidekiq), because it holds only a descriptor
+#   and resolves the live provider from {Registry} at call time.
+# * {ReauthMiddleware} is a redis-client middleware that re-issues AUTH on a
+#   long-lived connection shortly before its token expires.
+#
+# Usage:
+#
+#   RedisCloudAuth.register!   # once, at boot
+#
+#   descriptor = { provider: :azure, resource: "https://redis.azure.com" }
+#   RedisClient.config(
+#     host: "cache.example.com", port: 10000, ssl: true,
+#     username: "<object-id>",
+#     password: RedisCloudAuth.credential(descriptor),
+#     custom: { credentials_provider: descriptor }
+#   )
+module RedisCloudAuth
+  class Error < StandardError; end
+
+  class << self
+    # Logger for re-auth failures (throttled). Defaults to a no-op; consumers
+    # (GitLab, mail_room, gitlab-exporter) can inject their own.
+    attr_writer :logger
+
+    def logger
+      @logger ||= Logger.new(File::NULL)
+    end
+
+    # The process-global provider registry.
+    def registry
+      Registry
+    end
+
+    # Convenience: a marshallable callable password for +descriptor+.
+    def credential(descriptor)
+      TokenCredential.new(descriptor)
+    end
+
+    # Register the re-auth middleware with redis-client. Call once at boot.
+    # It is a no-op on connections whose config has no credentials_provider
+    # descriptor in `custom`.
+    def register!
+      require "redis-client"
+      RedisClient.register(ReauthMiddleware)
+    end
+  end
+end

metadata

@@ -0,0 +1,80 @@
+--- !ruby/object:Gem::Specification
+name: redis-cloud-auth
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- GitLab
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: redis-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.14'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.14'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Pluggable credentials providers (Microsoft Entra, Amazon ElastiCache
+  IAM, ...) that authenticate Redis connections with short-lived tokens, plus a redis-client
+  middleware that re-authenticates long-lived connections before the token expires.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/redis_cloud_auth.rb
+- lib/redis_cloud_auth/providers/azure.rb
+- lib/redis_cloud_auth/providers/elasticache.rb
+- lib/redis_cloud_auth/providers/gcp.rb
+- lib/redis_cloud_auth/reauth_middleware.rb
+- lib/redis_cloud_auth/registry.rb
+- lib/redis_cloud_auth/token_credential.rb
+- lib/redis_cloud_auth/version.rb
+homepage: https://gitlab.com/gitlab-org/ruby/gems/redis-cloud-auth
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.23
+specification_version: 4
+summary: Rotating-token (cloud identity) authentication for Redis via redis-client
+  middleware
+test_files: []