Guidance Required: Recommended Databases and Configuration for Session Store in UAA (v78.0.2)

[Arun-coder2013]

We are using UAA version 78.0.2 with session data managed via SPRING_SESSION. Our current database is MySQL Aurora Serverless v2, and we have observed issues with table-level locks when deleting expired sessions. This is causing disruptions in the login flow and resulting in failed user authentication attempts.

Request for Guidance:

1. Database Recommendations:

• Which databases are best suited for storing session data to prevent locking issues and support high concurrency during login operations?

2. Session Store Configuration Best Practices:

• What are the recommended best practices for configuring the session store in UAA to ensure optimized performance and reliable session management?

3. Mitigation of Locking/Blocking Issues:

• Any specific strategies or configurations you recommend to resolve the current locking and blocking issues, particularly SPRING_SESSION

Thanks

[fhanik]

TLDR; We don't have guidance based on real world experience. But we do have musings.

Disclaimer: None of the contributors' installations are currently using database backed session stores. All of our installations rely on the memory store, with sticky sessions. Therefor we have limited exposure to the challenges, and our guidance may not be valuable.

With our latest version, we are now running in Spring Boot, and therefor could potentially defer all of the implementation to Spring Boot and Spring Session

What this could mean:

1. We remove the servlet.session configuration in UAA
2. Extensions/configurations to the UAA could simply configure the spring.session namespace to enable/configure different session stores (not use the servlet.session config)

After a brief discussion among the contributor, there was consensus that Redis may be a better backend than a relation database.

If using a relational database, then using a separate JDBC connection pool that is configured without locking and transactions would be considered a safer and more scalable approach.