Skip to content

Commit 687f514

Browse files
committed
mysql cleanup
1 parent 4efd243 commit 687f514

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

en/identity-server/5.11.0/docs/setup/token-persistence.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -127,15 +127,17 @@ By default, JWT access-token generation or validation triggers interactions with
127127

128128
### Why optimize JWT Acces token persistence?
129129

130-
In large-scale WSO2 Identity Server deployments, especially with millions of users and high concurrency, the number of tokens stored in the database can grow quickly, making it harder to scale. This can lead to reduced performance and lower Transactions Per Second (TPS) for token generation. For instance, a telecom provider with 1.4 million subscribers and a token generation rate of 1,000 per second might struggle with scaling using traditional methods like adding more nodes, partitioning the database, or running token cleanup scripts.
131-
To address this, token persistence optimization helps by not storing access tokens. This approach avoids storing tokens during generation while still supporting essential features like token revocation and refresh grants, improving scalability and performance.
130+
In large-scale WSO2 Identity Server deployments, especially with millions of users and high concurrency, the number of tokens stored in the database can grow quickly, making it harder to scale. This can lead to reduced performance and lower Transactions Per Second (TPS) for token generation. To address this, token persistence optimization helps by not storing access tokens. This approach avoids storing access tokens during generation while still supporting essential features like token revocation and refresh grants, improving scalability and performance.
132131

133132
- **Reduce database queries during token request**: When a token is issued, the **access token** will no longer be stored in the `IDN_ACCESS_TOKEN` table. Only the **refresh token** will be stored. As a result, authorization grants like **Client Credentials**, which do not issue a refresh token, will experience improved throughput due to the reduction in database query overhead.
134133
- **Efficient database storage**: When tokens are stored in the persistent access_token mode, new entries are added to the database with each token request, even if the same refresh token is used. However, with the **non-persistent access token** feature enabled, only the **refresh token** is stored. If the current refresh token is still valid for the grant, no additional database rows will be added during token requests, leading to more efficient database storage.
135134
- **Improved token validation**: With the **non-persistent access token** feature enabled, revoked tokens can be stored in the database. However, deployments have the option to opt out of storing revoked tokens and can instead listen for revoked token events, providing greater flexibility in token management. This approach is particularly beneficial when the Identity Server acts as a **Key Manager** for **WSO2 API Manager**, as the Gateway can self-validate JWTs without additional hops to the Key Manager, improving performance and reducing latency.
136135

137136
### Things to consider when using JWT access token persistence optimization
138137

138+
- This mode is particularly suitable for the following scenarios:
139+
- When most token requests are based on authorization grants such as **Client Credentials**, which do not issue a refresh token.
140+
- When **Refresh Token Grants** are configured **without refresh token rotation**, reducing the need for persistent token tracking.
139141
- The **token persistence optimization** feature works only with **JWT access tokens**, as they can be self-validated.
140142
- When enabling this feature in an existing setup:
141143
- **Opaque token generation** will continue to work as expected for applications configured to use opaque tokens.

0 commit comments

Comments
 (0)