Need to add an OAuth2AuthorizedClientService implementation that gets OAuth2AuthorizedClient from the cache. In some cases this is better than InMemoryOAuth2AuthorizedClientService or JdbcOAuth2AuthorizedClientService. For example, the application runs on several instances, each instance can access the OAuth2AuthorizedClient in a shared distributed cache, such as Hazelcast or Redis. CacheOAuth2AuthorizedClientService:
@Override
@SuppressWarnings("unchecked")
public <T extends OAuth2AuthorizedClient> T loadAuthorizedClient(String clientRegistrationId, String principalName) {
Assert.hasText(clientRegistrationId, "clientRegistrationId cannot be empty");
Assert.hasText(principalName, "principalName cannot be empty");
ClientRegistration registration = this.clientRegistrationRepository.findByRegistrationId(clientRegistrationId);
if (registration == null) {
return null;
}
return (T) this.cache.get(new OAuth2AuthorizedClientId(clientRegistrationId, principalName));
}
This option will improve application performance.
Comment From: Crain-32
You should be able to put @Cacheable over that function.
Check out Spring's Caching Abstraction - https://docs.spring.io/spring-framework/reference/integration/cache.html
Comment From: franticticktick
I think this solution is better:
@Bean
public CachedOAuth2AuthorizedClientService cachedOAuth2AuthorizedClientService(CacheManager cacheManager) {
return new CachedOAuth2AuthorizedClientService(cacheManager.getCache("authorizedClients"));
}
Because caching API has aop implementation, it’s better not to add extra overhead to the spring security API.
Comment From: marcusdacoregio
Hi, @CrazyParanoid.
As @Crain-32 said, you should be able to provide your own OAuth2AuthorizedClientService implementation that caches the value, either by using Spring Cache or any other mechanism.
In summary, the reason that we won't add it in Spring Security is that our implementation probably won't do a better job than those robust cache solutions that are available out there.