reta commented on code in PR #3370:
URL: https://github.com/apache/cxf/pull/3370#discussion_r3775141579
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProvider.java:
##########
@@ -86,18 +96,65 @@ public JCacheOAuthDataProvider(String configFileURL,
String accessTokenCacheKey,
String refreshTokenCacheKey,
boolean storeJwtTokenKeyOnly) {
+ this(configFileURL, bus, clientCacheKey, accessTokenCacheKey,
refreshTokenCacheKey,
+ storeJwtTokenKeyOnly, CacheTTLs.ETERNAL);
+ }
+
+ // cacheTTLs lets the access/refresh token caches be evicted by the JCache
infrastructure
+ // itself once entries age out, independently of any application-level
expiry check;
+ // a TTL <= 0 (CacheTTLs.ETERNAL by default) leaves the corresponding
cache eternal
+ public JCacheOAuthDataProvider(String configFileURL,
Review Comment:
@coheigea thanks for the change, what concerns me is that `cacheTTLs` gives
a wrong impression that TTL will be configured for each cache, but that is not
the case: if the configuration has dedicated cache preset (like below)
```xml
<cache alias="cxf.oauth2.accesstoken.cache">
<key-type>java.lang.String</key-type>
<value-type>org.apache.cxf.rs.security.oauth2.common.ServerAccessToken</value-type>
<heap unit="entries">100</heap>
<jsr107:mbeans enable-management="false" enable-statistics="false"/>
</cache>
```
the cacheTTL will be effectively ignored. I don't want to complicate it but
also looking for intuitive API usage, may be instead of `CacheTTLs cacheTTLs`
we introduce something like `JCacheCreator` (or alike) that will be used to
create a cache when the is no one in configuration? Wdyt?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
