Scope of RelyingParty object

[muhammadwasay]

Is it ok to create one instance of RelyingParty class at the time application bootstraping and reuse this instance. i.e a Singleton instance for whole java application.
1 - will this instance be threadsafe?
2- is it ok to use the same instance for handling both registeration operations and authentication operations?

What if i create a new RelyingParty instance for every start / finish registeration/authentication operation and then leave it for garbage collection.

[emlun]

Hi!

1. Yes, as noted in the README:

   No mutable state or side effects - everything (except builders) is thread safe

   So as long as you only reuse the RelyingParty instance, not the RelyingPartyBuilder, you should be fine.

2. Yes, that is the intended use.

What if i create a new RelyingParty instance for every start / finish registeration/authentication operation and then leave it for garbage collection.

That would probably be unnecessarily slow, but should be fine. There's a small amount of validation logic that runs during RelyingParty construction, and the builder itself of course takes a few instructions to finish. I haven't benchmarked it, but I would guess it should take somewhere on the order of 1-10 ms or less to instantiate a RelyingParty.