Hydrator mutator cache

[juan131]

Hi everyone,

According to Oathkeeper documentation, the Hydrator mutator can be configured to cache responses from the configured API.

However, I'm not able to make it work. This is the relevant configuration:

(...)
mutators:
  (...)
  hydrator:
    config:
      api:
        url: https://{{custom-domain}}/v1/hydrator
      cache:
        enabled: true
        ttl: 24h
    enabled: true
(...)

Oahtkeeper version: v0.39.0

I have been tried to test it and I can confirm that my custom API endpoint responds with the exact same modified AuthenticationSession struct (same response body) when accessing with the same credentials on consecutive calls. However, even the responses are identical, Oathkeeper always send the POST request to the API ignoring any possible cached response.

I also saw in Oathkeeper logs:

{"audience":"application","level":"debug","msg":"Cache reject item","service_name":"ORY Oathkeeper","service_version":"v0.39.0","time":"2022-08-11T08:53:23Z"}

So, here are my questions:

• Does anyone know how does the hydrator mutator's cache works? I mean, does it cache the responses from the configured API?
• How can I check that cache is actually working?
• What cache system is it using? Saved in memory? If saved in memory, what resources should I configure for Oathkeeper replicas?
• Can different Oathkeeper replicas share the cache (e.g. using Redis)?

Thanks in advance!

[juan131]

Responding myself to "What cache system is it using? Saved in memory?":

• It seems it's using Ristretto

See: https://github.com/ory/oathkeeper/blob/master/pipeline/mutate/mutator_hydrator.go#L61