Document more clearly that username and password are not used when spring.data.redis.url is set

[alexisgayte]

https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/data/redis/PropertiesRedisConnectionDetails.java#L41

Configuration via URL doesn't allow username and password to be passed separately.
This is problematic in a prod environment where these data need to be encrypted.

I know there is a workaround : using params directly however if I recall Lettuce allows it.
The fix would be if username is null/empty try to pick the param.

[wilkinsona]

This is an intentional design choice. In the past, we tried to combine multiple properties when configuring RabbitMQ but it was confusing for users and a source of subtle bugs. We wouldn't want to open up the possibility with Redis.

Making a change here would also be backwards incompatible as we currently document that the url overrides the host, port, username, and password:

spring-boot/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/data/redis/RedisProperties.java

Line 45 in fdf2f20

* Connection URL. Overrides host, port, username, and password. Example:

You can either store the whole URL has a secret that's retrieved from an encrypted store, or use the separate host, port, username, and password properties and handle the username and password as secrets.

[alexisgayte]

Sorry for picking this up again, I still fell there is an bug/issue/missed there.

In your case (which is less lenient) we probably should manage it via error.
if url set and password/username set --> throw an error.

The current situation is ambiguous. I also understand that is not really a priority.

[wilkinsona]

In your case (which is less lenient) we probably should manage it via error.

Yeah, that would be nice. We have MutuallyExclusiveConfigurationPropertiesException that can be thrown when multiple properties that should be mutually exclusive have been set at the same time. Unfortunately, we can't use it here as it only works well when it's added at the same time as the properties.

At the moment, if someone has host, port, username and password set somewhere, they can override them by setting the uri property. Unfortunately, there's no good way to unset a property so if we change the implementation to instead throw a MutuallyExclusiveConfigurationPropertiesException exception, we'd break things for them.

[alexisgayte]

Just to clarify the reason why I got into it, as I realised it is important and not documented.

When setting redis I got the url from a cloud provider without user/password. (user password are set separately).

I looked at spring.data.redis configuration (autocompleted), picked "url" and populate it then I did the same for "username" and "password".

This was looking fine as database are configured the same way. But then when running the app, user and password weren't populated.
That was due to this ticket. I believe I am not going to be the only one to fall into it.

[philwebb]

I've reopened this issue and repurposed it to improve the documentation.