[keycloak-dev] Caching of identity provider links

[Marek Posolda]

Until now, we don't have support for caching of identityProvider 
(social) links. So every social login or every going to "federated 
identities" tab in account management needs to send DB queries. I was 
looking at fixing it and I've send PR 
https://github.com/keycloak/keycloak/pull/2404 . It turned to be a bit 
tricky because of:

1) Caching needs to be done on both directions. For social login, you 
need to lookup user by social link. But on the other hand, you also need 
to look all social/identityProvider links of particular user when you go 
to account management etc.

2) Because of "store token" option, the link may need to be updated in 
DB quite often (in theory even during each social login).

I was thinking that storing links directly on CachedUser doesn't work 
very well, because during each update of social link (which may be often 
because of "store token") the user would need to be fully invalidated 
from cache. Having separate cache entry for each social link also has 
some downsides (many items in cache, need to have separate entry for 
store the all links of user anyway). So I ended up with having the cache 
entry, which contains list of all links of particular user. It needs to 
be updated when any social link is added,removed or updated. This seemed 
to me like good compromise. WDYT?

There are also entries for lookup user by federated identity, so you 
don't need to query DB during social login.

So ATM there are not DB queries during social login or during go to 
"federated identities" . I hope I handled all corner cases and 
invalidations correctly, but if someone want to take look it will be 
good. I don't want to add new regressions atm :-)

Marek