Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
None
-
None
Description
The OAUTH2 and LDAP authentication providers should be changed to cache authentication results for a short (configurable) period. If the same authentication provider receives the same credentials again (i.e. matching username and password in the case of LDAP), it should reuse the cached authentication result. The cached authentication result should expire automatically. Negative authentication results should be cached too.
This will serve to reduce load on authentication backends (such as Directories). It will be especially useful when the REST API to used for programmatically monitoring the Broker which otherwise may create an excessive load on the backend.
The authentication provider must not retain the user passwords in clear. The size of the cache should be constrained.