{ "schema_version": 2, "id": "develop/clients/jedis/amr", "title": "Connect to Azure Managed Redis", "url": "https://redis.io/docs/latest/develop/clients/jedis/amr/", "summary": "Learn how to authenticate to an Azure Managed Redis (AMR) database", "tags": [ "docs", "develop", "stack", "oss", "rs", "rc", "oss", "kubernetes", "clients" ], "last_updated": "2026-09-08T15:41:24+01:00", "page_type": "content", "content_hash": "d9e480ae12624cab908ae0128f126c0f2eabd0bfa6387415bf09fc8a68e2fb70", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "The [`redis-authx-entraid`](https://github.com/redis/jvm-redis-authx-entraid) package\nlets you authenticate your app to\n[Azure Managed Redis (AMR)](https://azure.microsoft.com/en-us/products/managed-redis)\nusing [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/).\nYou can authenticate using a system-assigned or user-assigned\n[managed identity](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)\nor a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals),\nletting `redis-authx-entraid` fetch and renew the authentication tokens for you automatically.\n\nSee\n[Use Microsoft Entra for cache authentication](https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication)\nin the Microsoft docs to learn how to configure Azure to use Entra ID authentication." }, { "id": "install", "title": "Install", "role": "setup", "text": "Install [`jedis`](https://redis.io/docs/latest/develop/clients/jedis) first,\nif you have not already done so.\n\nIf you are using Maven, add\nthe following dependency to your `pom.xml` file:\n\n[code example]\n\nIf you are using Gradle, add the following dependency to your\n`build.gradle` file:\n\n[code example]" }, { "id": "create-a-tokenauthconfig-instance", "title": "Create a `TokenAuthConfig` instance", "role": "content", "text": "The `TokenAuthConfig` class contains the authentication details that you\nmust supply when you connect to Redis. Chain the methods of the\n`EntraIDTokenAuthConfigBuilder` class together (starting with the `builder()`\nmethod) to include the details you need, as shown in the following example:\n\n[code example]\n\nSome of the details you can supply are common to different use cases:\n\n- `secret()`: A string containing the [authentication secret](https://learn.microsoft.com/en-us/purview/sit-defn-azure-ad-client-secret).\n- `authority()`: A string containing the [authority](https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration#authority)\n URL.\n- `scopes()`: A set of strings defining the [scopes](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc)\n you want to apply. Configure your client application to acquire a Microsoft Entra token for scope, `https://redis.azure.com/.default` or `acca5fbb-b7e4-4009-81f1-37e38fd66d78/.default` (as detailed at [Microsoft Entra ID for authentication](https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/managed-redis/managed-redis-entra-for-authentication#microsoft-entra-client-workflow)) \n with the\n [Microsoft Authentication Library (MSAL)](https://learn.microsoft.com/en-us/entra/identity-platform/msal-overview)\n\n(See [Advanced configuration options](#advanced-configuration-options) below\nto learn more about the options for controlling token request retry and timeout\nbehavior.)\n\nYou can also add configuration to authenticate with a [service principal](#serv-principal)\nor a [managed identity](#mgd-identity) as described in the sections below." }, { "id": "serv-principal", "title": "Configuration for a service principal", "role": "configuration", "text": "Add `clientId()` to the `EntraIDTokenAuthConfigBuilder` chain to specify\nauthentication via a service principal, passing the ID token string as\na parameter. (See the\n[Microsoft EntraID docs](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals)\nfor more information about service principals.)\n\n[code example]" }, { "id": "mgd-identity", "title": "Configuration for a managed identity", "role": "configuration", "text": "You can also authenticate to AMR using a managed identity (see the\n[Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) to learn more about managed identities).\n\nFor a system assigned managed identity, simply add the `systemAssignedManagedIdentity()`\nmethod to the `EntraIDTokenAuthConfigBuilder` chain:\n\n[code example]\n\nFor a user assigned managed identity, add `userAssignedManagedIdentity()`. This\nrequires a member of the `UserManagedIdentityType` enum (to select a\n`CLIENT_ID`, `OBJECT_ID`, or `RESOURCE_ID`) as well as the `id` string itself:\n\n[code example]" }, { "id": "connect-using-defaultjedisclientconfig", "title": "Connect using `DefaultJedisClientConfig`", "role": "content", "text": "When you have created your `TokenAuthConfig` instance, you are ready to\nconnect to AMR.\nThe example below shows how to include the `TokenAuthConfig` details in a\n`JedisClientConfig` instance and use it with the `RedisClusterClient` connection.\nThe connection uses\n[Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security),\nwhich is recommended and enabled by default for managed identities. See\n[Connect to your production Redis with TLS](https://redis.io/docs/latest/develop/clients/jedis/connect#connect-to-your-production-redis-with-tls) for more information about\nTLS connections, including the implementation of the `createSslSocketFactory()`\nmethod used in the example.\n\n[code example]" }, { "id": "advanced-configuration-options", "title": "Advanced configuration options", "role": "content", "text": "The `TokenAuthConfig` class has several other options that you can\nset with the `EntraIDTokenAuthConfigBuilder.builder()`. These give you\nmore precise control over the way the token is renewed:\n\n[code example]\n\nThese options are explained below:\n\n- `expirationRefreshRatio`: a `float` value representing the fraction\n of a token's lifetime that should elapse before attempting to\n refresh it. For example, a value of 0.75 means that you want to\n refresh the token after 75% of its lifetime has passed.\n- `lowerRefreshBoundMillis`: the minimum amount of the token's lifetime\n (in milliseconds) remaining before attempting to refresh, regardless\n of the `expirationRefreshRatio` value. Set this to zero if you want\n the refresh time to depend only on `expirationRefreshRatio`.\n- `tokenRequestExecTimeoutInMs`: the maximum time (in milliseconds) to\n wait for a token request to receive a response. A timeout occurs if this limit is exceeded.\n- `maxAttemptsToRetry`: the maximum number of times to retry a token\n request before aborting.\n- `delayInMsToRetry`: the time (in milliseconds) to wait before\n retrying a token request after a failed attempt. This provides a mechanism to request throttling to prevent an excessive number of token requests." } ], "examples": [ { "id": "install-ex0", "language": "xml", "code": "\n redis.clients.authentication\n redis-authx-entraid\n 0.1.1-beta1\n", "section_id": "install" }, { "id": "install-ex1", "language": "bash", "code": "implementation 'redis.clients.authentication:redis-authx-entraid:0.1.1-beta1'", "section_id": "install" }, { "id": "create-a-tokenauthconfig-instance-ex0", "language": "java", "code": "TokenAuthConfig authConfig = EntraIDTokenAuthConfigBuilder.builder()\n .secret(\"\")\n .authority(\"\")\n // Other options...\n .build();", "section_id": "create-a-tokenauthconfig-instance" }, { "id": "serv-principal-ex0", "language": "java", "code": "TokenAuthConfig authConfig = EntraIDTokenAuthConfigBuilder.builder()\n .clientId(\"\")\n // ...\n .build();", "section_id": "serv-principal" }, { "id": "mgd-identity-ex0", "language": "java", "code": "TokenAuthConfig authConfig = EntraIDTokenAuthConfigBuilder.builder()\n .systemAssignedManagedIdentity()\n // ...\n .build();", "section_id": "mgd-identity" }, { "id": "mgd-identity-ex1", "language": "java", "code": "TokenAuthConfig authConfig = EntraIDTokenAuthConfigBuilder.builder()\n .userAssignedManagedIdentity(\n UserManagedIdentityType.CLIENT_ID,\n \"\"\n )\n // ...\n .build();", "section_id": "mgd-identity" }, { "id": "connect-using-defaultjedisclientconfig-ex0", "language": "java", "code": "TokenAuthConfig authConfig = EntraIDTokenAuthConfigBuilder.builder()\n // Chain of options...\n .build();\n\nSSLSocketFactory sslFactory = createSslSocketFactory(\n \"./truststore.jks\",\n \"secret!\", // Use the password you specified for `keytool`\n \"./redis-user-keystore.p12\",\n \"secret!\" // Use the password you specified for `openssl`\n);\n\nJedisClientConfig config = DefaultJedisClientConfig.builder()\n // Include the `TokenAuthConfig` details.\n .authXManager(new AuthXManager(authConfig))\n .ssl(true).sslSocketFactory(sslFactory)\n .build();\n\n// AMR databases have clustering enabled by default.\nRedisClusterClient jedis = RedisClusterClient.builder()\n .hostAndPort(new HostAndPort(\"\", ))\n .clientConfig(config)\n .build();\n\n// Test the connection.\nSystem.out.println(String.format(\"Database size is %d\", jedis.dbSize()));", "section_id": "connect-using-defaultjedisclientconfig" }, { "id": "advanced-configuration-options-ex0", "language": "java", "code": "TokenAuthConfig authConfig = EntraIDTokenAuthConfigBuilder.builder()\n .expirationRefreshRatio(0.75)\n .lowerRefreshBoundMillis(100)\n .tokenRequestExecTimeoutInMs(100)\n .maxAttemptsToRetry(10)\n .delayInMsToRetry()\n // ...\n .build();", "section_id": "advanced-configuration-options" } ] }