Skip to content

Append the IdType (membershipType/memberType) to the cache key#663

Merged
maximthomas merged 1 commit intoOpenIdentityPlatform:masterfrom
sp193:id-repo-cache-fix
Oct 13, 2023
Merged

Append the IdType (membershipType/memberType) to the cache key#663
maximthomas merged 1 commit intoOpenIdentityPlatform:masterfrom
sp193:id-repo-cache-fix

Conversation

@sp193
Copy link
Contributor

@sp193 sp193 commented Oct 13, 2023

This should fix #662.

Append the IdType (membershipType/memberType) to the cache key, to avoid mixing up the result sets.
Previously, IdCachedServicesImpl's getMembers() and getMembership() did not consider the IdType, thus the results could get mixed up, leading to unexpected behaviour if the results would differ. Consequences may include a temporary inability of AM to correctly evaluate policies, resulting in correct enforcement of policies by the gateway. The result of the policy evaluation may also be cached, making the issue last longer than the lifespan of the entry within the cache.

The IdType is now suffixed to the key. For example, these would have been equivalent, without the change:

IdCachedServicesImpl.getMemberships(): Cache hit for key = id=admin,ou=user,o=iot_platform,o=wisx,ou=services,dc=openam,dc=forgerock,dc=org_role.
IdCachedServicesImpl.getMemberships(): Cache hit for key = id=admin,ou=user,o=iot_platform,o=wisx,ou=services,dc=openam,dc=forgerock,dc=org_group.

@maximthomas maximthomas merged commit 3d38ca7 into OpenIdentityPlatform:master Oct 13, 2023
@sp193 sp193 deleted the id-repo-cache-fix branch October 13, 2023 04:42
@maximthomas
Copy link
Contributor

@sp193 thanks for the contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

IdCachedServicesImpl member cache may incorrectly cache member set upon login

2 participants