separate cache variables for each caching mechanism

internal/auth/options.go

@@ -38,6 +38,8 @@ import (
 // CookieHTTPOnly - bool - set httponly cookie flag
 // RequestTimeout - duration - overall request timeout
 // AuthCodeSecret - string - the seed string for secure auth codes (optionally base64 encoded)
+// GroupCacheProviderTTL - time.Duration - cache TTL for the group-cache provider used for on-demand group caching
+// GroupsCacheRefreshTTL - time.Duratoin - cache TTL for the groups fillcache mechanism used to preemptively fill group caches
 // PassHostHeader - bool - pass the request Host Header to upstream (default true)
 // SkipProviderButton - bool - if true, will skip sign-in-page to directly reach the next step: oauth/start
 // PassUserHeaders - bool (default true) - pass X-Forwarded-User and X-Forwarded-Email information to upstream
@@ -89,6 +91,7 @@ type Options struct {
 
 	AuthCodeSecret string `envconfig:"AUTH_CODE_SECRET"`
 
+	GroupCacheProviderTTL time.Duration `envconfig:"GROUP_CACHE_PROVIDER_TTL" default: "10m"`
 	GroupsCacheRefreshTTL time.Duration `envconfig:"GROUPS_CACHE_REFRESH_TTL" default:"10m"`
 	SessionLifetimeTTL    time.Duration `envconfig:"SESSION_LIFETIME_TTL" default:"720h"`
 
@@ -303,7 +306,7 @@ func newProvider(o *Options) (providers.Provider, error) {
 		}
 		tags := []string{"provider:okta"}
 
-		groupsCache := providers.NewGroupCache(oktaProvider, o.GroupsCacheRefreshTTL, oktaProvider.StatsdClient, tags)
+		groupsCache := providers.NewGroupCache(oktaProvider, o.GroupCacheProviderTTL, oktaProvider.StatsdClient, tags)
 		singleFlightProvider = providers.NewSingleFlightProvider(groupsCache)
 	default:
 		return nil, fmt.Errorf("unimplemented provider: %q", o.Provider)