[Feature Request] Extensibility allows customers to bring their distributed cache or hybrid cache in IdentityModel 8

[jmprieur]

Is your feature request related to a problem? Please describe.
Some partners request to have an L1/L2 cache for metadata

Describe the solution you'd like
An extensibility mechanism to provide a distributed cache? IDistributedCache in .NET 9 or the new hybrid cache in .NET 9?

[jmprieur]

Today, IdentityModel uses the EventBaseLRUCache for two purposes:

• the (OpenIdConnect) Configuration LKG as a EventBaseLRUCache<DateTime, Configuration> in BaseConfigurationManager
• an InMemoryCryptoProviderCache, which contains two caches for signature providers (signing signature providers and verifying signature providers)
  • EventBasedLRUCache<string, SignatureProvider> _signingSignatureProviders;
  • EventBasedLRUCache<string, SignatureProvider> _verifyingSignatureProviders;

This cache is used in the KeyVaultCryptoProvider which is going to be removed in IdentityModel 8.

The proposal is to:

• replace the implementation using EventBasedLRUCache by HybridCache (brought with .NET 8)
• possibly have an implementation of HybridCache with the EventBasedLRUCache?
• Surface HybridCache (which is an abstract class) in the constructor of BaseConfiguration

We won't touch the InMemoryCryptoProviderCache?

• how would that work with DI? design to be provided in IdWeb (and extended to MISE)

[GeoK]

@jmprieur Hybrid Cache seems to still be in an API design phase. Would leveraging IDistributedCache on BaseConfiguration be sufficient? I don't think any changes to InMemoryCryptoProviderCache should be part of this feature request.

Adding IDistributedCache to IdentityModel.Tokens will set a precedent of adding M.Extensions* to IdentityModel.
Microsoft.Extensions.Caching.Abstractions is lightweight but could still cause dependency conflicts on net461.
On that note, would each IdentityModel target depend on different M.Extensions version, or we are thinking about standardizing on v9?

[jmprieur]

Yes, IDistributedCache would be a wiser choice for the moment.

No indeed. we should not touch InMemoryCryptoProviderCache (as I believe I wrote above). Only the BaseConfigurationManager.

Yes, let's standardize to v8..0 and v9.0 for net9.0, until net9,.0 GAes at which point we'll move to v.9.0/ That's what the .NET team recommended.

[jodydonetti]

Hi, I don't know about the specifics of IdentityModel Extensions for .NET, but if there's a caching abstraction to implement (maybe an interface?), then FusionCache can be used as a possible implementation: it is an hybrid cache (L1 or L1+L2), production ready, used for years, fully observable, with resiliency features and more.

Here's a nice intro thanks to the hospitality of the On .NET team.

Also, Data API Builder uses it as their caching engine.