Add HybridCache for IMDSv2 Attestation Token Caching by Robbie-Microsoft · Pull Request #5539 · AzureAD/microsoft-authentication-library-for-dotnet

Robbie-Microsoft · 2025-10-21T21:08:53Z

Summary

Implements a new hybrid caching strategy for IMDSv2 attestation tokens with both in-memory and file-based persistence.

Changes

Added IHybridCache.cs - Interface for hybrid cache operations
Added HybridCache.cs - Hybrid cache implementation with:
- In-memory cache for fast access within process
- File-based cache for persistence across app restarts
- Cross-process synchronization using named OS mutex
- Automatic expired token cleanup
- Atomic file operations to prevent corruption
Modified ImdsV2ManagedIdentitySource.cs - Updated to use HybridCache to cache MAA tokens

Benefits

Improved performance with dual-layer caching
Cross-process token sharing
Robust error handling with graceful fallback
Comprehensive logging for diagnostics

TODO: Testing

Comprehensive unit tests covering all cache scenarios
Thread safety and concurrency validation
File persistence and cross-instance testing

* Changes discovered from manual testing * removed dead comment * removed another dead comment

* init * added comments

resource

…5494)

* Add ResetStateForTest API for test * Keep same type * Address PR comments

* attestation * address pr comments * remove console * pr comments * pr comments

…dentity Applications (#5511)

…nit Tests (#5514)

…store MAA tokens

bgavrilMS · 2025-10-22T09:28:33Z

+    /// For persistent implementations, cross-process synchronization should be considered.
+    /// Hybrid implementations should synchronize between memory and persistent storage when possible.
+    /// </remarks>
+    internal interface IHybridCache


I am not sure about the name, as it conflicts with https://learn.microsoft.com/en-us/aspnet/core/performance/caching/hybrid?view=aspnetcore-9.0

bgavrilMS · 2025-10-22T09:44:24Z

+        /// <exception cref="OperationCanceledException">
+        /// Thrown when the operation is canceled via the cancellation token.
+        /// </exception>
+        Task RemoveAsync(long key, CancellationToken ct);


nit: I believe it's customary to return Task to indicate if an entry was actually removed.

bgavrilMS · 2025-10-22T09:45:01Z

+        /// <exception cref="OperationCanceledException">
+        /// Thrown when the operation is canceled via the cancellation token.
+        /// </exception>
+        Task SetAsync(long key, string token, DateTimeOffset expiresOnUtc, CancellationToken ct);


Why don't you set a AttestationTokenResponse ?

bgavrilMS · 2025-10-22T10:01:12Z

+        /// 
+        /// This entry structure is used for both in-memory and file cache storage.
+        /// </remarks>
+        private class CacheEntry


Why do you need this object when you have AttestationTokenResponse ?

bgavrilMS · 2025-10-22T11:34:59Z

+                    rsaCng.Key.Handle != null &&
+                    !rsaCng.Key.Handle.IsInvalid)
+                {
+                    return rsaCng.Key.Handle.DangerousGetHandle().ToInt64();


I think you should use a key thumbprint instead. When I asked copilot it said that "The handle does not represent the key’s content, just its memory address in the current process."

A key thumbprint (e.g., SHA-256 hash of the public key) would be a stable, cryptographically unique identifier for the key material, regardless of process or machine. This is a standard approach for caching or identifying cryptographic keys.

rsaCng.Key.Export(CngKeyBlobFormat.GenericPublicBlob))
Hash the blob (e.g., using SHA-256)
Use the hash as the cache key.

Thoughts?

We can also put the thumbprint in the ManagedIdentityKeyInfo (via the ctor) so as to not compute it everytime.

gladjohn · 2025-10-22T13:36:15Z

+
+            // Create named mutex for cross-process synchronization
+            // Using a deterministic name based on cache file path to ensure same mutex across processes
+            _mutexName = $"Global\\MSAL_AttestationCache_{_cacheFilePath.GetHashCode():X8}";


not sure if this will work, as different processes may compute different mutex names?

gladjohn · 2025-10-22T13:38:21Z

+
+            _requestContext.Logger.Verbose(() => $"[ImdsV2] GetAttestationJwtAsync called for cache key: {cacheKey}");
+
+            var cache = new HybridCache(_requestContext.Logger);


HybridCache implements IDisposable but is not disposed? should this be wrapped in using for short‑lived use?

gladjohn · 2025-10-22T13:41:47Z

+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"[HybridCache] Error loading file cache from {_cacheFilePath}: {ex.Message}. Created a new file.");


but the new file isn't created here?

gladjohn · 2025-10-22T13:43:42Z

+
+                _logger.Verbose(() => $"[HybridCache] Loading cache from file: {_cacheFilePath}");
+
+                var json = await Task.Run(() => File.ReadAllText(_cacheFilePath)).ConfigureAwait(false);


can we not use ReadAllTextAsync?

gladjohn · 2025-10-22T13:44:09Z

+
+                // Write to temp file first, then move to avoid corruption during write
+                var tempFile = _cacheFilePath + ".tmp";
+                await Task.Run(() => File.WriteAllText(tempFile, json)).ConfigureAwait(false);


WriteAllTextAsync?

gladjohn · 2025-10-22T13:45:13Z

+                {
+                    if (!string.IsNullOrEmpty(memoryEntry.Token) && now + s_expirySkew < memoryEntry.ExpiresOnUtc)
+                    {
+                        _logger.Info(() => $"[HybridCache] Cache hit in memory for key: {key}");


gladjohn · 2025-10-22T13:45:18Z

+
+                    // Token expired in memory, remove it
+                    s_memoryCache.TryRemove(keyString, out _);
+                    _logger.Info(() => $"[HybridCache] Expired token removed from memory cache for key: {key}");


gladjohn · 2025-10-22T13:46:37Z

+                throw new ArgumentNullException(nameof(token));
+            }
+
+            _logger.Info(() => $"[HybridCache] SetAsync called for key: {key}, expires: {expiresOnUtc}");


gladjohn · 2025-10-22T13:46:50Z

+                throw new ObjectDisposedException(nameof(HybridCache));
+            }
+
+            _logger.Info(() => $"[HybridCache] RemoveAsync called for key: {key}");


gladjohn · 2025-10-22T13:46:57Z

+                    return Task.CompletedTask;
+                }, ct).ConfigureAwait(false);
+
+                _logger.Info(() => $"[HybridCache] Remove operation completed for key: {key}");


gladjohn · 2025-10-22T13:47:20Z

+                    {
+                        cache.Remove(key);
+                    }
+                    _logger.Info(() => $"[HybridCache] Cleaned up {keysToRemove.Count} expired entries from file cache");


gladjohn · 2025-10-22T13:58:18Z

+
+            _logger.Info(() => $"[HybridCache] Initializing cache with directory: {cacheDirectory}");
+
+            Directory.CreateDirectory(cacheDirectory);


can this operation fail?

Robbie-Microsoft · 2025-10-23T21:29:20Z

+                _logger.Verbose(() => $"[HybridCache] Attempting to acquire mutex: {_mutexName}");
+
+                // Try to acquire mutex with timeout to avoid deadlocks
+                mutexAcquired = _namedMutex.WaitOne(_mutexTimeout);


This is where all the unit tests in HybridCacheTests fail. It seems the mutext can't be acquired multiple times in the same test.

See the test: GetAsync_ValidCachedToken_ReturnsToken

CC @gladjohn, can you experiment with this when you get time?

* initial * pr comments * pr comments * pr comments

…brid_cache_for_maa

gladjohn · 2026-01-13T21:33:00Z

closing as not planned

Robbie-Microsoft and others added 30 commits August 4, 2025 15:19

CSR Metadata request acts as a probe for ImdsV2 (#5359)

38dbae3

Merge branch 'main' into rginsburg/msiv2_feature_branch

4b2453d

Merge branch 'main' into rginsburg/msiv2_feature_branch

faa28bc

Merge branch 'main' into rginsburg/msiv2_feature_branch

7bc1735

Merge branch 'main' into rginsburg/msiv2_feature_branch

024e7b4

Imdsv2: Generate CSR and execute CSR request (#5427)

8c03bb3

Minor adjustments

24f599a

Merge branch 'main' into rginsburg/msiv2_feature_branch

b75e879

private -> public, for unit tests

ea15d19

ImdsV2: Implemented downlevel polyfill for CertificateRequest (#5454)

2ce7e1b

Merge branch 'main' into rginsburg/msiv2_feature_branch

fdf2038

ImdsV2: Acquire Entra Token Over mTLS (#5431)

ddc2117

Merge branch 'main' into rginsburg/msiv2_feature_branch

d0b0edf

ImdsV2: Miscellanious Updates Discovered by Manual Testing (#5477)

5825f50

* Changes discovered from manual testing * removed dead comment * removed another dead comment

ImdsV2: Added Additional Headers to the Entra Token Request (#5459)

15bbfc1

MSIV2: net8.0 Unit Test Fixes (#5480)

d41a874

Merge branch 'main' into rginsburg/msiv2_feature_branch

8c4c255

MSI V2 - Adding Attestation package for mTLS POP MSI flows (#5483)

2518f1b

* init * added comments

Merge branch 'main' into rginsburg/msiv2_feature_branch

e06b4b0

Fixed broken unit test + created helper function for code re-use

8099d17

MSI V2 client side keys (#5448)

774e01e

ImdsV2: Integrated .WithMtlsProofOfPossession (#5490)

0897cce

[MSI v2] - Pass the actual resource to IMDS (#5497)

717e59e

resource

ImdsV2: Entra Request: "expires_in" is now lumped into "expires_on" (#…

d180eb1

…5494)

ImdsV2: WithExtraQueryParameters (#5492)

42587b5

Merge branch 'main' into rginsburg/msiv2_feature_branch

693e917

Add ResetStateForTest API for test (#5489)

c2eddde

* Add ResetStateForTest API for test * Keep same type * Address PR comments

undid commit where code was supopsed to be stashed

087130e

[MSI v2] - Enable attestation in pop flows (#5496)

89ff42a

* attestation * address pr comments * remove console * pr comments * pr comments

ImdsV2: .WithMtlsProofOfPossession Will Throw on NET462 for Managed I…

8464e83

…dentity Applications (#5511)

Robbie-Microsoft and others added 8 commits October 2, 2025 13:03

Merge branch 'main' into rginsburg/msiv2_feature_branch

c706896

IMDSv2: Fixed Broken Unit Test (#5516)

1ae351b

ImdsV2: Throw on MTLS when OS is not Windows (#5520)

1c399c3

ImdsV2: Added Caching for the IMDS Endpoint Env Variable + Improved U…

732c9d6

…nit Tests (#5514)

Merge branch 'main' into rginsburg/msiv2_feature_branch

2fc14f7

Merge branch 'main' into rginsburg/msiv2_feature_branch

ce4f407

Merge branch 'main' into rginsburg/msiv2_feature_branch

16f0280

Created interface and implementation for HybridCache, and used it to …

9ea94d3

…store MAA tokens

Robbie-Microsoft changed the title ~~Add HybridCache for IMDSv2 attestation token caching~~ Add HybridCache for IMDSv2 Attestation Token Caching Oct 21, 2025

bgavrilMS reviewed Oct 22, 2025

View reviewed changes

gladjohn reviewed Oct 22, 2025

View reviewed changes

Robbie-Microsoft added 2 commits October 23, 2025 17:20

Added unit tests (they don't run)

ae3c8e6

fixed misalignment of curly braces

1af6df6

Robbie-Microsoft commented Oct 23, 2025

View reviewed changes

gladjohn and others added 4 commits October 24, 2025 12:15

[MSI V2] - Adds Authentication Operation to MSI v2 mTLS flows (#5533)

8922b98

* initial * pr comments * pr comments * pr comments

Merge branch 'main' into rginsburg/msiv2_feature_branch

f7e3973

ImdsV2: Non-mTLS POP Requests Fall Back to ImdsV1 (#5531)

358a9d8

Merge branch 'rginsburg/msiv2_feature_branch' into rginsburg/msiv2_hy…

781b175

…brid_cache_for_maa

Base automatically changed from rginsburg/msiv2_feature_branch to main October 29, 2025 22:48

gladjohn closed this Jan 13, 2026


		_requestContext.Logger.Verbose(() => $"[ImdsV2] GetAttestationJwtAsync called for cache key: {cacheKey}");

		var cache = new HybridCache(_requestContext.Logger);


		_logger.Verbose(() => $"[HybridCache] Loading cache from file: {_cacheFilePath}");

		var json = await Task.Run(() => File.ReadAllText(_cacheFilePath)).ConfigureAwait(false);


		_logger.Info(() => $"[HybridCache] Initializing cache with directory: {cacheDirectory}");

		Directory.CreateDirectory(cacheDirectory);

Conversation

Robbie-Microsoft commented Oct 21, 2025

Summary

Changes

Benefits

TODO: Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Robbie-Microsoft Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gladjohn commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Robbie-Microsoft Oct 23, 2025 •

edited

Loading