Regarding AddOidcStateDataFormatterCache service,

[vinakumar]

I'm looking to reduce the size of the state parameter when sending requests to an external Identity Provider. To achieve this, I'm working on integrating AddOidcStateDataFormatterCache in IdentityServer.

Since I want to avoid using in-memory or distributed memory cache, I'm configuring AddDistributedSqlServerCache instead. Below is the configuration I’ve added in the Startup class:

services.AddDistributedSqlServerCache(options =>
 {
     options.ConnectionString = "ConnectionString";
     options.SchemaName = "dbo";
     options.TableName = "TestCache";
     options.ExpiredItemsDeletionInterval = TimeSpan.FromMinutes(5);
 });

 services.AddOidcStateDataFormatterCache();

Questions:

1. How can I explicitly set SlidingExpiration for the cache entries?

I'm unsure how to configure SlidingExpiration when using AddOidcStateDataFormatterCache. Could you please guide me on how to explicitly apply SlidingExpiration to the entries stored in the SQL cache?

So far, I’ve only added the configuration shown above, and it seems that the caching behavior is being handled automatically. I haven’t made any customizations related to expiration settings.

2. How does ExpiredItemsDeletionInterval work?

I understand this setting defines how often expired items are scanned and removed. Could you clarify:

• How this cleanup is triggered?
• Whether any background service or job is required in production to ensure expired entries are deleted?
• Any best practices or additional steps we should consider when using this approach in a production environment?

[wcabus]

1. How can I explicitly set SlidingExpiration for the cache entries?

When using AddOidcStateDataFormatterCache, IdentityServer is applying either an absolute or sliding expiration value on the cached entry, as you can see in our source code.

There is no way to change this behavior other than rolling your own implementation of ISecureDataFormat<AuthenticationProperties> and setting the OpenIdConnectOptions.StateDataFormat property manually. However, our implementation deliberately chooses to use an absolute expiration value when the AuthenticationProperties.ExpiresUtc has a value set, since that's when the authentication ticket expires.

2. How does ExpiredItemsDeletionInterval work?

The Distributed SQL Server cache implementation is provided by Microsoft, so we can't really comment nor provide support on that. A quick search however reveals that the cache service cleans up expired data whenever a cache request is being made. See the usage of ScanForExpiredItemsIfRequired for more information.