Adding a cache layer for OAuth2 token validation in REST API

[malinthaprasan]

Adding a cache layer in Product REST APIs' OAuth2 token validations. It consists of two caches:

1. TokenCache: Valid token infomation are stored against the access token.
2. InvalidTokenCache: Invalid tokens are stored

The summary of the flow:

The token is checked in TokenCache and if it exists validation info is taken from there, check the expiry and continues.
If not, the token is checked in InvalidTokenCache for invalid tokens.
If token doesn't exist in both, normal key validation DB call goes. (this doesn't include a n/w call)

Scope validation is not cached here. It is comparatively low cost operation because the retrieval of URITemplates/scope information is already cached. For the REST of the stuff, it will have a for loop for iterating and validating scopes which is not a costly operation.

By default, the cache expiry is set to 300s (5mins). To change this, set below in deployment.toml.

[apim.cache.restapi_token]
enable = true
expiry_time = "300s"

It will add below configs in api-manager.xml under CacheConfigurations upon server start.

        <!-- Enable/Disable token caching at the Product REST APIs-->
        <EnableRESTAPITokenCache>true</EnableRESTAPITokenCache>
        <!-- Expiry time for the apim REST API token cache -->
        <RESTAPITokenCacheExpiry>300</RESTAPITokenCacheExpiry>