add a controller to force refresh

[iay]

For some applications, it would be nice to have an endpoint to poke to force a refresh.

[trscavo]

How would access to that endpoint be managed?

[iay]

Excellent question, you definitely wouldn't want just anyone to poke it any time they wanted to, that would be a horrible denial of service issue.

I can think of two relatively simple options:

• An IP protection system similar to that used by the Shibboleth IdP configuration for sensitive endpoints.
• Some sort of secret token that is part of the configuration, as is used in things like GitLab