How to access the Redis from another tenant with Entra ID authenticcation

Question

Hi Team,

I have an App Service in Tenant A that needs to access a Redis instance in Tenant B. To enable this, I created a Service Principal in Tenant B, linked to a multi-tenant app registered in Tenant A, and granted it the Redis Data Contributor role.

However, when attempting to connect to the Redis instance using Python and MSAL on my local machine, I encounter an error indicating an invalid username-password pair. For authentication, I'm using the Service Principal's Object ID as the username and a token obtained via the Azure.Identity library (ConfidentialClientApplication) as the password.

Answer 1

Hi Kefei Qian

Greetings!

As we understand that, you are trying to connect to a Redis instance in another tenant using Entra ID authentication but are running into an issue with the authentication process. 

Here are a few things to check:

• Ensure Entra ID Authentication is Enabled: Verify that Microsoft Entra authentication is enabled for your Redis instance in Tenant B. You can do this in the Azure portal under Settings > Authentication.
• Use the Correct Username Format: Instead of using the Object ID of the Service Principal, try using its Application ID as the username. Some Redis configurations require this format. please refer this document https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication#microsoft-entra-client-workflow
• Check Token Acquisition: Double-check how you’re obtaining the token with the Azure.Identity library. It should look something like this:

from azure.identity import ConfidentialClientApplication
 
client = ConfidentialClientApplication(
    client_id='YOUR_CLIENT_ID',
    client_secret='YOUR_CLIENT_SECRET',
    authority='https://login.microsoftonline.com/YOUR_TENANT_ID'
)
 
token_response = client.acquire_token_for_client(scopes=["https://redis.azure.com/.default"])

• Authorization Command: After obtaining the token, ensure that your Redis client sends an AUTH command to authenticate with the Redis server using the Object ID as the user and the token as the password.
• Token Expiry Management: Implement a mechanism to refresh the token before it expires to avoid connection disruptions. It’s recommended to fetch a new token at least 3 minutes prior to expiry.
• Firewall and Private Link Configuration: If applicable, make sure that your Redis instance allows traffic from your App Service in Tenant A, which may involve configuring firewall rules or private endpoints.

I would request you to refer the below mentioned links for more information.

https://github.com/redis/redis-py-entraid

https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/samples/azure-aad-auth-with-redis-py.md

I hope this information helps. Please do let us know if you have any further queries.