Skip to content

SOLR-16951: Add PKI Auth Caching for both generation and validation #3334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

HoustonPutman
Copy link
Contributor

https://issues.apache.org/jira/browse/SOLR-16951

  • Default PKI TTL has been increased to 10 seconds
  • The PKI Generation cache will expire cached tokens after 1/4 of the TTL time, to give a minimum 3/4 of the TTL time for transportation.
  • The PKI Generation cache will start refreshing cached tokens 1/2 of the expiration time (1/8 of the TTL time), to give time for the asynchronous refresh to complete before the token is expired. I would set this to expirationTime - 50ms, but CaffeineCache requires a get() in order to trigger the async refresh, so we want to give time between refreshTime and expireTime for a request to come in to trigger the refresh. 1/2 of the expiration time should be fine here.
  • I don't expect to get more than 100 users that often, so I think this is a safe cache limit for generation. For validation, the node name is included in the token, so we need an order of magnitude bigger cache. I chose 1000 here, but this can probably be changed if we need to. The validation cache isn't as important as the generation cache, so it shouldn't be a huge deal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant