Suggest setting quarkus.security.ldap.cache.enabled #46688
Conversation
Status for workflow
|
|
🎊 PR Preview 60cbe47 has been successfully built and deployed to https://quarkus-pr-main-46688-preview.surge.sh/version/main/guides/
|
| <3> The URL used by our test resource. Tests may leverage `LdapServerTestResource` provided by Quarkus as link:{quickstarts-blob-url}/security-ldap-quickstart/src/test/java/org/acme/elytron/security/ldap/ElytronLdapExtensionTestResources.java[we do] in the test coverage of the example application. | ||
| <2> The URL used by our test resource. Tests may leverage `LdapServerTestResource` provided by Quarkus as link:{quickstarts-blob-url}/security-ldap-quickstart/src/test/java/org/acme/elytron/security/ldap/ElytronLdapExtensionTestResources.java[we do] in the test coverage of the example application. | ||
| <3> `{0}` is substituted by the `uid`. | ||
| <4> Without this configuration, every request to your service will cause an additional roundtrip to the LDAP server. Therefore, it's a common practice to cache these result to improve performance, but the tradeoff is that there will be a delay between changes in the LDAP getting effective in your service. The default cache max-age is `60s`. |
There was a problem hiding this comment.
Thanks @t1, this information will be useful.
However, I'd like to propose to turn into a Note, that would inform users that by default, LDAP request is made each time, and you can set this property if you'd like to optimize, etc
The reason I propose it is because with this current text we essentially recommend enabling the cache, in which case it would be reasonable for users to ask, why do we have to configure it ourselves?
The note, with pros and cons, would make it more obvious why users have to make this decision
|
By the way, how is this cache managed ? |
Elytron does that, not us. On the Quarkus side, the feautre is about creating cache security realm, see 4dc83f9#diff-536222a00f1e17a090ff0327620053fa1db46827f4491350fa42809c80243a67 for details. |
|
Thanks @michalvavrik, I'm assuming it is memory based by default. |
As discussed in #46507