Server-side session token caching in WIF and Thinktecture IdentityModel

Once a user has been authenticated session tokens are emitted by the SAM as cookies. These session cookies are fairly large (given that they contain claims) and so it is desirable to optimize them to a smaller size (especially for browsers like Safari which have issues with large cookies).

In order to reduce session token size, WIF supports server-side session security token caching. I already discussed how to enable this feature here. Additionally, a CacheSessionsOnServer convenience function has been added to Thinktecture IdentityModel (which must be invoked from Init in global.asax). More on this API in a bit.

The default implementation of the server-side cache (provided by WIF) simply maintains the tokens in-memory on the web server and thus is a poor choice for production given the propensity for application domain recycles and the use of server farms. To then further address this issue, WIF supports custom server-side cache implementations by deriving from SessionSecurityTokenCache. Unfortunately this cache base class is meant for both passive scenarios (browser-based, WS-Federation) and active scenarios (programmatic, WS-Trust) and as such is slightly more complex than I’d like it to be.

If your application is only a browser-based application then instead of implementing the full-fledged WIF cache you can instead implement a cache derived from the PassiveRepositorySessionSecurityTokenCache base class provided in Thinktecture IdentityModel. It uses a combination of the built-in in-memory cache as well as a pluggable persistence layer to support longer-term and cross-machine caching (in a database or distributed in-memory cache, for example). This implementation is specifically focused on the web-based scenarios (as opposed to the WCF-based scenarios), thus the name Passive. To that end, there are some methods of the WIF session security token cache base class that are not implemented due to the lack of use for web-based scenarios.

The PassiveRepositorySessionSecurityTokenCache models token via the ITokenCacheRepository interface. The interface definition is:

public interface ITokenCacheRepository
{
    void AddOrUpdate(TokenCacheItem item);
    TokenCacheItem Get(string key);
    void Remove(string key);
    void RemoveAllBefore(DateTime date);
}

 public class TokenCacheItem
{
    [Key]
    public string Key { get; set; }
    public DateTime Expires { get; set; }
    public byte[] Token { get; set; }
}

TokenCacheItem has a string primary key, an expiration and the token itself (as a byte[]). The repository models adding or updating the cache item, getting a cache item, removing a cache item and removing stale cache items past a particular date.

There is no standard implementation of the token cache repository in IdentityModel. This implementation is left to the application developer. As an example, though, if you were to use entity framework as the repository then it might look like this:

public class EFTokenCacheDataContext : DbContext
{
    public EFTokenCacheDataContext()
        :base("name=TokenCache")
    {
    }

    public DbSet<TokenCacheItem> Tokens { get; set; }
}

public class EFTokenCacheRepository : ITokenCacheRepository
{
    public void AddOrUpdate(TokenCacheItem item)
    {
        using (EFTokenCacheDataContext db = new EFTokenCacheDataContext())
        {
            DbSet<TokenCacheItem> items = db.Set<TokenCacheItem>();
            var dbItem = items.Find(item.Key);
            if (dbItem == null)
            {
                dbItem = new TokenCacheItem();
                dbItem.Key = item.Key;
                items.Add(dbItem);
            }
            dbItem.Token = item.Token;
            dbItem.Expires = item.Expires;
            db.SaveChanges();
        }
    }

    public TokenCacheItem Get(string key)
    {
        using (EFTokenCacheDataContext db = new EFTokenCacheDataContext())
        {
            DbSet<TokenCacheItem> items = db.Set<TokenCacheItem>();
            return items.Find(key);
        }
    }

    public void Remove(string key)
    {
        using (EFTokenCacheDataContext db = new EFTokenCacheDataContext())
        {
            DbSet<TokenCacheItem> items = db.Set<TokenCacheItem>();
            var item = items.Find(key);
            if (item != null)
            {
                items.Remove(item);
                db.SaveChanges();
            }
        }
    }

    public void RemoveAllBefore(DateTime date)
    {
        using (EFTokenCacheDataContext db = new EFTokenCacheDataContext())
        {
            DbSet<TokenCacheItem> items = db.Set<TokenCacheItem>();
            var query =
                from item in items
                where item.Expires <= date
                select item;
            foreach (var item in query)
            {
                items.Remove(item);
            }
            db.SaveChanges();
        }
    }
}

Given the nature of the session security token cache in WIF, complex initialization can’t be performed in web.config. Instead configuration will need to be done programmatically. Configuring the PassiveRepositorySessionSecurityTokenCache can be done in code in global.asax:

protected void Application_Start()
{
    PassiveSessionConfiguration.ConfigureSessionCache(new EFTokenCacheRepository());
}

The prior configuration only configures which cache and repository to use on the server-side. It does not configure the SAM to use the smaller cookie format. To configure the smaller cookie format the IsReferenceMode flag must be set to true on the SAM. There is no web.config setting for this, so it needs to be set at runtime and has been provided via a helper called method in the IdentityModel library via the API CacheSessionsOnServer on the PassiveModuleConfiguration class. Unfortunately given the nature of the SAM as a http module this needs to be configured on each and every instance which is only possible from the Init method in global.asax, so this code will need to be added to the hosting application:

public override void Init()
{
    PassiveModuleConfiguration.CacheSessionsOnServer();
}

Init is invoked each time a http module is created and thus is where instance properties of the http modules can be modified.

I have a sample that uses EF as the backing store for the cache here.

Happy token caching. :)