Oauth2 Middleware scalability limit and resilience issues with code grant flow and token storage

[drewby]

Expected Behavior

Oauth2 Middleware should scale to multiple instances without the use of request affinity. It should also be resilient to restarts.

Actual Behavior

Oauth2 Middleware uses in-memory session state to store information during auth code grant flow and to store the client token at the end of authorization. This requires requests to always return to the same instance of the dapr sidecar and offers no resilience in the case of a restart of the daprd instance.

Steps to Reproduce the Problem

For scale:

1. Configure daprd with a scaled deployment, no affinity on ingress
2. After authorization, make multiple requests
3. Some requests will require new authentication

For resilience:

1. Use Oauth2 component to authenticate
2. Restart daprd
3. Next request will require authorization

Proposals

Use cookies instead of session state to store data during auth code grant flow and the client token. Enable session state to be stored in a cache (Redis, etc).

Release Note

RELEASE NOTE: FIX Oauth2 Middleware resilient storage of client token

[ItalyPaleAle]

This should be a blocker to make the components stable (#2621 and #2622)

However, I don't think we should persist the tokens anywhere, as that requires a data store and to query the data store on every request.

Instead, we should issue our own JWT, which is a bearer token so can be verified by Dapr without querying a database. The JWT will contain the token issued by the OAuth2 server and will be encrypted (JWE) in case the token issued by the server contains confidential information.

[ItalyPaleAle]

@drewby I have a POC for the OAuth2 middleware that stores tokens in cookies self-contained. Although it works, I'm running into limitations due to the fact that Azure AD tokens can be very large. Would love your feedback too on #2963

[drewby]

@drewby I have a POC for the OAuth2 middleware that stores tokens in cookies self-contained. Although it works, I'm running into limitations due to the fact that Azure AD tokens can be very large. Would love your feedback too on #2963

I started to comment here and then saw your link. I will comment on the PR.

[ItalyPaleAle]

Final one is #2967

as for splitting, we can’t do that because the 4KB limit is per-domain.

regarding safety, the tokens are stored in cookies as encrypted JWTs

[drewby]

Got it. I saw my question/comment were all addressed in the PR.