search

IdentityModel / IdentityModel.AspNetCore.OAuth2Introspection

ASP.NET Core authentication handler for OAuth 2.0 token introspection
Apache License 2.0
147 stars 66 forks source link

Setting cache duration based on response from introspection endpoint #187

Open SandroGlueck opened 10 months ago

SandroGlueck commented 10 months ago

We are currently using IdentityModel.AspNetCore.OAuth2Introspection in many applications, using a wrapped Keycloak as authorization server. Some of our business cases are very time critical, therefore we want to enable caching of introspection results. However in an effort to improve performance while not sacrificing security, we have the requirement to cache introspection results for varying amounts of time. In our case, the recommended cache time is generated on the authorization server and returned as an additional custom claim with the introspection result (based mainly on the token type).

I don't see a way in which this could be achieved with the current implementation, as there is no part between the introspection request and the creation of the cache entry, where custom code could be executed.

My current idea to solve this, would be to add a new event that is fired after the introspection request is done. We could then update the Cache Duration based on the response from our authorization server.

If this would be okay, and there is no other (better) solution, I could propose a PR.

leastprivilege commented 10 months ago

Hi,

thanks! Feel free to propose a PR. Due to other priorities, we cannot guarantee we can process that quickly though.