--- title: Configuring Trust Framework attribute caching for production description: For higher environments, including testing and production, you can define an external attribute cache for the Trust Framework. component: pingauthorize version: 11.0 page_id: pingauthorize:pingauthorize_server_administration_guide:paz_tf_attribute_cache_embedded canonical_url: https://docs.pingidentity.com/pingauthorize/11.0/pingauthorize_server_administration_guide/paz_tf_attribute_cache_embedded.html revdate: December 1, 2025 section_ids: before-you-begin: Before you begin steps: Steps setting-up-redis-external-attribute-caching-with-dsconfig: Setting up Redis external attribute caching with dsconfig before-you-begin-2: Before you begin about-this-task: About this task steps-2: Steps example: Example: example-2: Example: result: Result --- # Configuring Trust Framework attribute caching for production For higher environments, including testing and production, you can define an external attribute cache for the Trust Framework. With the Policy Decision Service set to embedded policy decision point (PDP) mode, the PingAuthorize Server is configured by default to cache attribute values in memory (for any attributes with a [defined caching strategy](../pingauthorize_policy_administration_guide/paz_attr_caching.html)). Alternatively, you can define an external attribute cache using the following Redis modes: * Single Redis instance * Single Redis instance using TLS * Replicated Redis * Redis Sentinel * Amazon Web Services (AWS) ElastiCache Redis - Admin console - dsconfig ### Before you begin To successfully assign an external Redis attribute cache to the Policy Decision Service, you must set **PDP Mode** to **Embedded**. ### Steps 1. In the PingAuthorize admin console, go to **Configuration > Authorization and Policies > External Attribute Caches**. 2. Click **New External Attribute Cache** and select your desired Redis mode from the list. ![Screen capture of the options in the New External Attribute Cache list, with arrows pointing to the button and a selected option](_images/paz_new_external_attribute_cache.png) 3. At minimum, enter the required values, as indicated by a red asterisk, and click **Save**. | | | | - | ------------------------------------------------------------------ | | | Hover over the question mark icon for more information on a field. | ![Screen capture of defining Redis configuration values for a new Redis cache, with arrows pointing to the required fields and the save button](_images/paz_external_redis_cache_config.png) 4. Go to **Configuration > Authorization and Policies > Policy Decision Service**. 5. In the **Trust Framework Attribute Cache Configuration** section, in the **External Attribute Cache** list, select the Redis cache you created in step 3. ![Screen capture of the External Attribute Cache list with arrows point to the list and the save button](_images/paz_policy_decision_srvc_redis_cache.png) 6. Click **Save** ## Setting up Redis external attribute caching with dsconfig ### Before you begin When using the `dsconfig set-policy-decision-service-prop` command, the new configuration must still be compliant with the following: * The `pdp-mode` property must be set to `embedded`. * The `deployment-package-source-type` property must be set to `store` or `static-file`. * If the `deployment-package-source-type` property is set to `store`, the `deployment-package-store` property must resolve to a valid deployment package store. * If the `deployment-package-source-type` property is set to `static-file`, the `deployment-package-store` property must resolve to a valid deployment package. ### About this task Here are the configuration options available for creating Redis external caches using the `dsconfig` tool. When using the `dsconfig create-external-attribute-cache` command, the new configuration must still be compliant with the required attributes associated with the specified cache type: | Option | Description | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | `mode` | Required. Specifies Redis mode. Accepted values: `single_instance`, `replicated`, `elasticache`, or `sentinel`. | | `nodeAddresses` | Required, only when `mode` is `single_instance`, `replicated`, or `sentinel`. Defines node addresses. A comma-separated list of Redis nodes. | | `replicationGroupId` | Required, only when `mode` is `elasticache`. Replication group ID. | | `masterName` | Required, only when `mode` is `sentinel`. Specifies name of the master node. | | `database` | Optional, only when `mode` is `sentinel`. Database index used for Redis connection. Default value is `0`. | | `scanInterval` | Optional, only when `mode` is `sentinel`. Redis cluster scan interval in milliseconds. Default value is `1000`. | | `checkSentinelList` | Optional, only when `mode` is `sentinel`. Enables Sentinels list check during startup. Default value is `false`. | | `username` | Optional, only when AUTH token authentication is enabled in the Redis provider. | | `password` | Optional, only when AUTH token authentication is enabled in the Redis provider. | ### Steps 1. Create the external attribute cache using the `dsconfig create-external-attribute-cache` command. For example: #### Example: ```shell $ dsconfig create-external-attribute-cache \ --cache-name 'Single Instance' \ --type redis-single-instance \ --set redis-node-addresses:redis://localhost:6379 ``` 2. Assign the defined external attribute cache to the Policy Decision Service. For example: #### Example: ```shell $ dsconfig set-policy-decision-service-prop \ --set 'external-attribute-cache:Single Instance' ``` ### Result Your external attribute cache has been defined and attached to the Policy Decision Service. There is no need to restart the server.