Configuring Trust Framework attribute caching for production

For higher environments, including testing and production, you can define an external attribute cache for the Trust Framework.

With the Policy Decision Service set to embedded policy decision point (PDP) mode, the PingAuthorize Server is configured by default to cache attribute values in memory (for any attributes with a defined caching strategy). Alternatively, you can define an external attribute cache using the following Redis modes:

Single Redis instance
Single Redis instance using TLS
Replicated Redis
Redis Sentinel
Amazon Web Services (AWS) ElastiCache Redis

Using the GUI

Setting up Redis external attribute caching in the UI

Before you begin

To successfully assign an external Redis attribute cache to the Policy Decision Service, you must set PDP Mode to embedded.

Steps

On the Configuration page of the PingAuthorize Administration Console, go to Authorization and Policies → External Attribute Caches.
Select your desired Redis mode from the New External Attribute Cache list.

Example:
At minimum, enter the required values, as indicated by a red asterisk, and click Save To PingAuthorize Server Cluster.

For more information on a field, click the question mark icon.

Example:

Screen capture of defining Redis configuration values for a new Redis cache, with arrows pointing to the required fields and the save button

Go to Authorization and Policies → Policy Decision Service.
Select your Redis cache name from the External Attribute Cache list in the Trust Framework Attribute Cache Configuration section and click Save To PingAuthorize Server Cluster.

Example:

Screen capture of the External Attribute Cache list with arrows point to the list and the save button

Alternatively, you can use the controls next to the External Attribute Cache list to create, edit, or remove external Redis caches:

Click the Plus icon to create a new external attribute cache.
Click the Pencil icon to edit the configuration of the selected attribute cache.
Click X to remove the attribute cache from the Policy Decision Service and revert the PDP to an in-memory attribute cache.

Using dsconfig

Setting up Redis external attribute caching with dsconfig

Before you begin

When using the dsconfig set-policy-decision-service-prop command, the new configuration must still be compliant with the following:

The pdp-mode property must be set to embedded.
The deployment-package-source-type property must be set to store or static-file.
- If the deployment-package-source-type property is set to store, the deployment-package-store property must resolve to a valid deployment package store.
- If the deployment-package-source-type property is set to static-file, the deployment-package-store property must resolve to a valid deployment package.

About this task

Here are the configuration options available for creating Redis external caches using the dsconfig tool. When using the dsconfig create-external-attribute-cache command, the new configuration must still be compliant with the required attributes associated with the specified cache type:

Option Description

Option	Description
`mode`	Required. Specifies Redis mode. Accepted values: `single_instance`, `replicated`, `elasticache`, or `sentinel`.
`nodeAddresses`	Required, only when `mode` is `single_instance`, `replicated`, or `sentinel`. Defines node addresses. A comma-separated list of Redis nodes.
`replicationGroupId`	Required, only when `mode` is `elasticache`. Replication group ID.
`masterName`	Required, only when `mode` is `sentinel`. Specifies name of the master node.
`database`	Optional, only when `mode` is `sentinel`. Database index used for Redis connection. Default value is `0`.
`scanInterval`	Optional, only when `mode` is `sentinel`. Redis cluster scan interval in milliseconds. Default value is `1000`.
`checkSentinelList`	Optional, only when `mode` is `sentinel`. Enables Sentinels list check during startup. Default value is `false`.
`username`	Optional, only when AUTH token authentication is enabled in the Redis provider.
`password`	Optional, only when AUTH token authentication is enabled in the Redis provider.

mode

Required. Specifies Redis mode. Accepted values: single_instance, replicated, elasticache, or sentinel.

nodeAddresses

Required, only when mode is single_instance, replicated, or sentinel. Defines node addresses. A comma-separated list of Redis nodes.

replicationGroupId

Required, only when mode is elasticache. Replication group ID.

masterName

Required, only when mode is sentinel. Specifies name of the master node.

database

Optional, only when mode is sentinel. Database index used for Redis connection. Default value is 0.

scanInterval

Optional, only when mode is sentinel. Redis cluster scan interval in milliseconds. Default value is 1000.

checkSentinelList

Optional, only when mode is sentinel. Enables Sentinels list check during startup. Default value is false.

username

Optional, only when AUTH token authentication is enabled in the Redis provider.

password

Optional, only when AUTH token authentication is enabled in the Redis provider.

Steps

Create the external attribute cache using the dsconfig create-external-attribute-cache command. For example:

Example:

$ dsconfig create-external-attribute-cache \
  --cache-name 'Single Instance' \
  --type redis-single-instance \
  --set redis-node-addresses:redis://localhost:6379

Assign the defined external attribute cache to the Policy Decision Service. For example:

Example:

$ dsconfig set-policy-decision-service-prop \
  --set 'external-attribute-cache:Single Instance'

Result

Your external attribute cache has been defined and attached to the Policy Decision Service. There is no need to restart the server.