Authorization Caching
Caching is used to store run-time authentication and authorization rules, which can be expensive to calculate.
This page describes the cache that can be configured on the Crowd server, to store users' authentication and per-application permissions for a specified period. For an overview of the other types of caching offered by Crowd, refer to Overview of Caching.
Caching of Users' Application Permissions on the Crowd Server — The Authorization Cache
Crowd can store users’ authentication status and per-application permissions in a local cache for a set period after retrieving this information from the directory and application data. The cache helps answer these questions:
- For a particular user: Is the user authenticated?
- For a particular user and application: Does the user have access to the application?
This feature is sometimes called the authorization cache or the "has access" cache.
We recommend keeping the cache enabled on the Crowd server for better performance. This is the default configuration.
When caching is enabled, users will continue to have access to applications for a short time after their username or permissions are removed. Access is retained until the server-side cache expires. Only disable the cache if you need changes to user access or permissions to take effect immediately.
To enable caching of user-to-application permissions on the Crowd server:
- Log in to the Crowd Administration Console.
- In the top navigation bar, go to Settings
.
- Select Enable Authorization Caching.
- Select Save.
Some applications may enable/disable caching based on the Crowd server setting
The Crowd API allows an application to query whether caching is enabled on the Crowd server (isCacheEnabled). The Crowd Java client does not make use of this API feature, because it makes more sense to have application caching configured entirely on the application side. If you have a Crowd-integrated custom application which does make use of this API call, then the setting on the Crowd server will affect your application-side caching as well.
Control Caching Behavior with Properties
You can use the following properties to manage authentication caching. How to configure system properties
Property name | Default value | Description |
|---|---|---|
| The same as | Sets how long, in minutes, a user’s authentication state stays cached. |
|
| When set to |