Skip to content

Refactor cache operations to use read-safe methods for concurrent environments #3129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ThaminduR merged 13 commits into from
Mar 25, 2026
Merged

Refactor cache operations to use read-safe methods for concurrent environments #3129

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
a96c298
Refactor cache operations to use read-safe methods for concurrent env…
Zeta201 Mar 20, 2026
4f52e3f
Bump kernel and framework version
Zeta201 Mar 20, 2026
3bea59d
Fix ambgious metadata conflict for javax.servlet.* that causes build …
Zeta201 Mar 20, 2026
9b8cb98
Refactor remaining cache operations to use read-safe methods for conc…
Zeta201 Mar 21, 2026
4c24bff
Bump framework version
Zeta201 Mar 24, 2026
847c4a2
Fix checkstyle issues
Zeta201 Mar 24, 2026
8cd241d
Add unit tests
Zeta201 Mar 24, 2026
6c40181
Address reviewer suggestions
Zeta201 Mar 25, 2026
992ad5c
Remove cache invalidation on read path
Zeta201 Mar 25, 2026
dcb37a6
Fix failing unit test with the write path change
Zeta201 Mar 25, 2026
3e23613
Address reviewer suggestions
Zeta201 Mar 25, 2026
46c8928
Exclude org.eclipse.equinox.http.service.api for modules
Zeta201 Mar 25, 2026
b1e53f9
Fix code style issues
Zeta201 Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions components/org.wso2.carbon.identity.discovery/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
<name>WSO2 Carbon - OAuth OpenId Connect Discovery</name>
<description>OpenId Connect Discovery Bundle</description>
<url>http://wso2.org</url>

<dependencies>
<dependency>
<groupId>commons-codec</groupId>
Expand Down Expand Up @@ -148,6 +149,7 @@
org.wso2.carbon.identity.discovery.*;
version="${identity.inbound.auth.oauth.exp.pkg.version}"
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.ciba/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,7 @@
org.wso2.carbon.identity.oauth.ciba.*;
version="${identity.inbound.auth.oauth.exp.pkg.version}",
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,7 @@
<Export-Package>
org.wso2.carbon.identity.oauth.common.*;version="${identity.inbound.auth.oauth.exp.pkg.version}"
</Export-Package>
<_contract>!JavaServlet</_contract>
Copy link
Copy Markdown
Contributor

@ThaminduR ThaminduR Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need these changes

Copy link
Copy Markdown
Contributor Author

@Zeta201 Zeta201 Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. otherwise the build fails with the following error:

Contracts [...] declare the same packages in their uses: directive: [javax.servlet, ...]

This issue occurs after upgrading the kernel version. It indicates that multiple JARs are attempting to declare themselves as the provider of the same package (javax.servlet), which leads to a conflict in OSGi package resolution.

In this case, the conflicting JARs are:

  • tomcat-servlet-api
  • org.eclipse.equinox.http.service.api

Copy link
Copy Markdown
Contributor Author

@Zeta201 Zeta201 Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Importantly, this is not a runtime conflict. Instead, it occurs during the build phase, where bnd enforces strict validation while generating the MANIFEST.MF. Due to the ambiguous metadata, bnd refuses to proceed.

</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.dcr/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@
org.wso2.carbon.identity.oauth.dcr.*;version="${identity.inbound.auth.oauth.exp.pkg.version}",
org.wso2.carbon.identity.oauth.dcr.handler.*;version="${identity.inbound.auth.oauth.exp.pkg.version}"
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
2 changes: 1 addition & 1 deletion ....oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/AuthzUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1375,7 +1375,7 @@ private static OAuthAppDO getAppInformation(OAuth2AuthorizeReqDTO authzReqDTO) t
} else {
oAuthAppDO = new OAuthAppDAO().getAppInformation(authzReqDTO.getConsumerKey());
}
AppInfoCache.getInstance().addToCache(authzReqDTO.getConsumerKey(), oAuthAppDO);
AppInfoCache.getInstance().addToCacheOnRead(authzReqDTO.getConsumerKey(), oAuthAppDO);
return oAuthAppDO;
}
}
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.extension/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@
<Export-Package>
org.wso2.carbon.identity.oauth.extension.*;version="${identity.inbound.auth.oauth.exp.pkg.version}"
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.par/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,7 @@
org.wso2.carbon.identity.oauth.par.*;
version="${identity.inbound.auth.oauth.exp.pkg.version}",
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.rar/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@
org.wso2.carbon.identity.oauth.rar.*;
version="${identity.inbound.auth.oauth.exp.pkg.version}",
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.stub/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@
org.wso2.carbon.identity.oauth.stub.*; version="${identity.inbound.auth.oauth.exp.pkg.version}",
org.wso2.carbon.identity.oauth2.stub.*; version="${identity.inbound.auth.oauth.exp.pkg.version}"
</Export-Package>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
1 change: 1 addition & 0 deletions components/org.wso2.carbon.identity.oauth.ui/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,7 @@
org.wso2.carbon.identity.oauth.ui.*;version="${identity.inbound.auth.oauth.exp.pkg.version}"
</Export-Package>
<Carbon-Component>UIBundle</Carbon-Component>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
2 changes: 2 additions & 0 deletions components/org.wso2.carbon.identity.oauth/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,11 +495,13 @@
org.wso2.carbon.identity.openidconnect.*;version="${identity.inbound.auth.oauth.exp.pkg.version}",
</Export-Package>
<DynamicImport-Package>*</DynamicImport-Package>
<_contract>!JavaServlet</_contract>
<ListenerManager-RequiredServices>
org.wso2.carbon.identity.oauth2.OAuth2Service,
org.wso2.carbon.identity.oauth2.OAuth2ScopeService,
org.wso2.carbon.identity.oauth.OAuthAdminServiceImpl
</ListenerManager-RequiredServices>
<_contract>!JavaServlet</_contract>
</instructions>
</configuration>
</plugin>
Expand Down
2 changes: 1 addition & 1 deletion ...on.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthAdminServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2723,7 +2723,7 @@ OAuthAppDO getOAuthApp(String consumerKey, String tenantDomain) throws InvalidOA
if (LOG.isDebugEnabled()) {
LOG.debug("OAuth app with consumerKey: " + consumerKey + " retrieved from database.");
}
AppInfoCache.getInstance().addToCache(consumerKey, oauthApp, tenantDomain);
AppInfoCache.getInstance().addToCacheOnRead(consumerKey, oauthApp, tenantDomain);
}
return oauthApp;
}
Expand Down
8 changes: 4 additions & 4 deletions ...ity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/AuthorizationGrantCache.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ public AuthorizationGrantCacheEntry getValueFromCacheByTokenId(AuthorizationGran
}
cacheEntry = getFromSessionStore(tokenId);
if (cacheEntry != null && key != null) {
super.addToCache(key, cacheEntry);
super.addToCacheOnRead(key, cacheEntry);
}
}
return cacheEntry;
Expand All @@ -130,7 +130,7 @@ public AuthorizationGrantCacheEntry getValueFromCacheByTokenId(AuthorizationGran
}
cacheEntry = getFromSessionStore(tokenId, operation);
if (cacheEntry != null) {
super.addToCache(key, cacheEntry);
super.addToCacheOnRead(key, cacheEntry);
}
}
return cacheEntry;
Expand All @@ -155,7 +155,7 @@ public AuthorizationGrantCacheEntry getValueFromCacheByToken(AuthorizationGrantC
}
cacheEntry = getFromSessionStore(replaceFromTokenId(key.getUserAttributesId()));
if (cacheEntry != null) {
super.addToCache(key, cacheEntry);
super.addToCacheOnRead(key, cacheEntry);
}
}
return cacheEntry;
Expand Down Expand Up @@ -238,7 +238,7 @@ public AuthorizationGrantCacheEntry getValueFromCacheByCode(AuthorizationGrantCa
}
cacheEntry = getFromSessionStore(replaceFromCodeId(key.getUserAttributesId()));
if (cacheEntry != null) {
super.addToCache(key, cacheEntry);
super.addToCacheOnRead(key, cacheEntry);
}
}
return cacheEntry;
Expand Down
18 changes: 18 additions & 0 deletions ....carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/OAuthCache.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@

package org.wso2.carbon.identity.oauth.cache;



import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
Expand Down Expand Up @@ -76,6 +78,22 @@ public void addToCache(OAuthCacheKey key, CacheEntry entry) {
}
}

@Override
public void addToCacheOnRead(OAuthCacheKey key, CacheEntry entry) {

if (entry instanceof AccessTokenDO) {
AccessTokenDO tokenDO = (AccessTokenDO) entry;
String tenantDomain = tokenDO.getAuthzUser().getTenantDomain();
if (LOG.isDebugEnabled()) {
LOG.debug(String.format("[AddToCacheOnRead] AccessTokenDO was added for the given token identifier: " +
"%s in the tenant: %s.", ((AccessTokenDO) entry).getTokenId(), tenantDomain));
}
super.addToCacheOnRead(key, entry, tenantDomain);
} else {
super.addToCacheOnRead(key, entry);
}
}

@Override
public void clearCacheEntry(OAuthCacheKey key, String tenantDomain) {

Expand Down
14 changes: 14 additions & 0 deletions ...tity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/OAuthScopeBindingCache.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,20 @@ public void addToCache(OAuthScopeBindingCacheKey key, Scope[] entry, int tenantI
}
}

/**
* Add a cache entry during a READ operation.
*
* @param key Key which cache entry is indexed.
* @param entry Actual object where cache entry is placed.
*/
public void addToCacheOnRead(OAuthScopeBindingCacheKey key, Scope[] entry, int tenantId) {

super.addToCacheOnRead(key, entry, tenantId);
if (log.isDebugEnabled()) {
log.debug("[AddToCacheOnRead] Scope bindings are added to the cache. \n" + ArrayUtils.toString(entry));
}
}

/**
* Retrieves a cache entry.
*
Expand Down
21 changes: 21 additions & 0 deletions ...on.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/cache/OAuthScopeCache.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,27 @@ public void addToCache(OAuthScopeCacheKey key, Scope entry, int tenantId) {
}
}

/**
* Add a cache entry during a READ operation.
*
* @param key Key which cache entry is indexed.
* @param entry Actual object where cache entry is placed.
*/
public void addToCacheOnRead(OAuthScopeCacheKey key, Scope entry, int tenantId) {

if (IdentityUtil.getIdentityCacheConfig(IDENTITY_CACHE_MANAGER, OAUTH_SCOPE_CACHE_NAME).isEnabled()) {
super.addToCacheOnRead(key, entry, tenantId);
if (log.isDebugEnabled()) {
log.debug("[AddToCacheOnRead] Scope is added to the cache. \n" + entry.toString());
}
}

for (ScopeBinding scopeBinding : entry.getScopeBindings()) {
OAuthScopeBindingCache.getInstance().clearCacheEntry(new OAuthScopeBindingCacheKey(scopeBinding
.getBindingType()), tenantId);
}
}

/**
* Retrieves a cache entry.
*
Expand Down
2 changes: 1 addition & 1 deletion ...rbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/OAuth2ScopeService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@ public Scope getScope(String name) throws IdentityOAuth2ScopeException {
if (log.isDebugEnabled()) {
log.debug("Scope is getting from the database. \n" + scope.toString());
}
OAuthScopeCache.getInstance().addToCache(new OAuthScopeCacheKey(name), scope, tenantID);
OAuthScopeCache.getInstance().addToCacheOnRead(new OAuthScopeCacheKey(name), scope, tenantID);
}

} catch (IdentityOAuth2ScopeServerException e) {
Expand Down
2 changes: 1 addition & 1 deletion ...auth/src/main/java/org/wso2/carbon/identity/oauth2/authz/AuthorizationHandlerManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -711,7 +711,7 @@ private OAuthAppDO getAppInformation(OAuth2AuthorizeReqDTO authzReqDTO) throws I
} else {
oAuthAppDO = new OAuthAppDAO().getAppInformation(authzReqDTO.getConsumerKey());
}
AppInfoCache.getInstance().addToCache(authzReqDTO.getConsumerKey(), oAuthAppDO);
AppInfoCache.getInstance().addToCacheOnRead(authzReqDTO.getConsumerKey(), oAuthAppDO);
return oAuthAppDO;
}
}
Expand Down
23 changes: 22 additions & 1 deletion ...ain/java/org/wso2/carbon/identity/oauth2/authz/handlers/util/ResponseTypeHandlerUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,7 +615,7 @@ private static AccessTokenDO getExistingTokenFromDB(OAuthAuthzReqMessageContext
if (TOKEN_STATE_ACTIVE.equals(existingToken.getTokenState()) && expireTime != 0 && cacheEnabled) {
// Active token retrieved from db, adding to cache if cacheEnabled
try {
addTokenToCache(getOAuthCacheKey(consumerKey, scope, authorizedUser.getUserId(),
addTokenToCacheOnRead(getOAuthCacheKey(consumerKey, scope, authorizedUser.getUserId(),
OAuth2Util.getAuthenticatedIDP(authorizedUser)), existingToken);
} catch (UserIdNotFoundException e) {
throw new IdentityOAuth2Exception("Error occurred while retrieving the user id for user: "
Expand Down Expand Up @@ -1141,6 +1141,27 @@ private static void addTokenToCache(OAuthCacheKey cacheKey, AccessTokenDO tokenB
}
}

private static void addTokenToCacheOnRead(OAuthCacheKey cacheKey, AccessTokenDO tokenBean) {

/*
* If no token persistence, the token will be not be cached against a cache key with userId, scope, client and
* idp. But, token will be cached and managed as an AccessTokenDO against the token identifier.
*/
if (OAuth2Util.isTokenPersistenceEnabled()) {
OAuthCache.getInstance().addToCacheOnRead(cacheKey, tokenBean);
}
// Adding AccessTokenDO to improve validation performance
OAuthCacheKey accessTokenCacheKey = new OAuthCacheKey(tokenBean.getAccessToken());
OAuthCache.getInstance().addToCacheOnRead(accessTokenCacheKey, tokenBean);
if (log.isDebugEnabled()) {
log.debug("Access token info was added to the cache for cache key : " + cacheKey.getCacheKeyString());
if (IdentityUtil.isTokenLoggable(IdentityConstants.IdentityTokens.ACCESS_TOKEN)) {
log.debug("Access token was added to OAuthCache for cache key : " + accessTokenCacheKey
.getCacheKeyString());
}
}
}

private static void removeTokenFromCache(OAuthCacheKey cacheKey, AccessTokenDO tokenBean) {

OAuthCache.getInstance().clearCacheEntry(cacheKey);
Expand Down
2 changes: 1 addition & 1 deletion .../java/org/wso2/carbon/identity/oauth2/dao/CacheBackedOAuthUserConsentedScopesDAOImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ public UserApplicationScopeConsentDO getUserConsentForApplication(String userId,
return entry.getUserApplicationScopeConsentDO();
}
UserApplicationScopeConsentDO userConsent = dao.getUserConsentForApplication(userId, appId, tenantId);
cache.addToCache(userId, new OAuthUserConsentedScopeCacheEntry(appId, userConsent), tenantId);
cache.addToCacheOnRead(userId, new OAuthUserConsentedScopeCacheEntry(appId, userConsent), tenantId);
return userConsent;
}

Expand Down
19 changes: 18 additions & 1 deletion ...g/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1051,6 +1051,23 @@ private void addTokenToCache(OAuthCacheKey cacheKey, AccessTokenDO existingAcces
}
}

private void addTokenToCacheOnRead(OAuthCacheKey cacheKey, AccessTokenDO existingAccessTokenDO) {
if (isHashDisabled && cacheEnabled) {
oauthCache.addToCacheOnRead(cacheKey, existingAccessTokenDO);
// Adding AccessTokenDO to improve validation performance
OAuthCacheKey accessTokenCacheKey = new OAuthCacheKey(existingAccessTokenDO.getAccessToken());
oauthCache.addToCacheOnRead(accessTokenCacheKey, existingAccessTokenDO);
if (log.isDebugEnabled()) {
log.debug("Access Token info was added to the cache for the cache key : " +
cacheKey.getCacheKeyString());
if (IdentityUtil.isTokenLoggable(IdentityConstants.IdentityTokens.ACCESS_TOKEN)) {
log.debug("Access token was added to OAuthCache for cache key : " + accessTokenCacheKey
.getCacheKeyString());
}
}
}
}

private OAuth2AccessTokenRespDTO createResponseWithTokenBean(OAuthTokenReqMessageContext tokenReqMessageContext,
AccessTokenDO existingAccessTokenDO,
long expireTimeMillis, String scope)
Expand Down Expand Up @@ -1313,7 +1330,7 @@ private AccessTokenDO getExistingTokenFromDB(OAuthTokenReqMessageContext tokenMs
if (TOKEN_STATE_ACTIVE.equals(existingToken.getTokenState()) &&
expireTime != 0) {
// Active token retrieved from db, adding to cache if cacheEnabled
addTokenToCache(cacheKey, existingToken);
addTokenToCacheOnRead(cacheKey, existingToken);
}
}
return existingToken;
Expand Down
Loading
Loading