ACL SETROLE

Create an ACL role with the specified rules or modify the rules of an existing role.

A role is a named, reusable set of permissions that can be assigned to any number of users with the role= rule of ACL SETUSER, so a policy is written once instead of being repeated in every user. See roles for more information.

If the role does not exist, the command creates it without any privilege. It then reads from left to right all the rules provided as successive arguments, setting the role ACL rules as specified. If the role already exists, the provided ACL rules are applied in addition to the rules already set, exactly as ACL SETUSER does for users. The rules are applied atomically: if any rule is invalid, the role is left unchanged.

A role accepts the command rules of ACL SETUSER, as well as selectors ((<rule list>)) and clearselectors. The rules that only make sense for a user are rejected with an error: on, off, reset, the password rules (>, <, #, !, nopass, resetpass), role= and resetroles. Roles cannot be nested.

Changes to a role take effect immediately for every user holding it. If the change removes access to Pub/Sub channels, the clients of those users that are subscribed to channels they can no longer access are disconnected.

Role names are case sensitive and may contain any printable ASCII character except for spaces, commas, quotes (" and ') and backslashes. Roles live in a namespace of their own, so a role may have the same name as a user, a command, or a category.

Note: a new role starts with access to all databases (alldbs), and to all Pub/Sub channels if acl-pubsub-default is set to allchannels, just like a new user. Since a user's own permissions and those of its roles are combined with OR logic, such a role grants those databases and channels to its users even if the user itself is restricted with resetdbs, db=<id> or resetchannels. Use db=<id> (or resetdbs) and resetchannels in the role rules to restrict the role itself. See database permissions.

Examples

127.0.0.1:6379> ACL SETROLE reader ~app:* +@read
OK
127.0.0.1:6379> ACL SETROLE ops ~* +info (+config|get)
OK
127.0.0.1:6379> ACL SETROLE reader on
(error) ERR Error in ACL SETROLE modifier 'on': Syntax error