[Question] How does token Caching work

[TheCreatorAMA]

I have dug around and was reading on how token caching works but I am still a bit confused and figured I would ask here in case anyone else would find this useful.

I have some code similar to the below:

oBOCreds, err := azidentity.NewOnBehalfOfCredentialWithSecret(tenantID, clientID, userAssertion, clientSecret, options)
if err != nil {
   return err
}

tokenOpts := policy.TokenRequestOptions{
   Scopes:   []string{"<scopes>"},
   TenantID: tenantID,
}

token, err := oBOCreds.GetToken(r.Context(), tokenOpts)
if err != nil {
   return err
}

This code gets called on every request but Im noticing that a new token is being generated each time. Im fairly positive im just not understanding something but as the user is there something I need to do to see if the client already has a token? Or does it happen automatically when credentials are made?

[timovv]

Hi @TheCreatorAMA, since your question is about the Go SDK I am transferring this issue to the Go repository.

[chlowell]

Thanks for opening this issue. All credentials that don't delegate to external tools cache tokens automatically, storing them in memory by default. These in-memory caches don't survive the credential instances that create them, so if your request handler calls NewOnBehalfOfCredential() for each incoming request, tokens it acquires while handling one request are unavailable while handling another. We do have a beta feature that enables caching tokens to disk, however OnBehalfOfCredential can't support that yet because its cache is uniquely unmarshallable (AzureAD/microsoft-authentication-library-for-go#455). I imagine you could cache OnBehalfOfCredential instances or token requests and responses, if that's feasible for your app, but I'm sorry to say that today we don't have a good solution in azidentity for your scenario.

[TheCreatorAMA]

That explanation helps! So if I cache the credential instances, the background in-memory caching should fetch a new token if needed right? To make sure I'm understanding this correctly.

[chlowell]

Yes. When your app calls GetToken(), a credential with a cache searches that and requests a new token only when the cache misses.

[TheCreatorAMA]

Alright makes sense thanks for the explanation!