You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-issues@jackrabbit.apache.org by "Joerg Hoh (Jira)" <ji...@apache.org> on 2023/09/04 17:14:00 UTC
[jira] [Resolved] (OAK-10428) UserPrincipalProvider updates group cache on every login
[ https://issues.apache.org/jira/browse/OAK-10428?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Joerg Hoh resolved OAK-10428.
-----------------------------
Resolution: Invalid
> UserPrincipalProvider updates group cache on every login
> --------------------------------------------------------
>
> Key: OAK-10428
> URL: https://issues.apache.org/jira/browse/OAK-10428
> Project: Jackrabbit Oak
> Issue Type: Task
> Components: authorization-principalbased
> Affects Versions: 1.56.0
> Reporter: Joerg Hoh
> Priority: Major
>
> Under traffic (by a single user) I see in a DocumentNodeStore setup this stacktrace for a lot of requests:
> {noformat}
> "qtp2052801890-41390" #41390 prio=5 os_prio=0 cpu=19882.72ms elapsed=3024.20s tid=0x0000564321465800 nid=0x3ec2a waiting on condition [0x00007f633f55f000]
> java.lang.Thread.State: WAITING (parking)
> at jdk.internal.misc.Unsafe.park(java.base@11.0.15/Native Method)
> - parking to wait for <0x00000006a0cac5f0> (a java.util.concurrent.locks.ReentrantLock$NonfairSync)
> at java.util.concurrent.locks.LockSupport.park(java.base@11.0.15/LockSupport.java:194)
> at java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(java.base@11.0.15/AbstractQueuedSynchronizer.java:885)
> at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireQueued(java.base@11.0.15/AbstractQueuedSynchronizer.java:917)
> at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(java.base@11.0.15/AbstractQueuedSynchronizer.java:1240)
> at java.util.concurrent.locks.ReentrantLock.lock(java.base@11.0.15/ReentrantLock.java:267)
> at org.apache.jackrabbit.oak.plugins.document.locks.StripedNodeDocumentLocks.acquire(StripedNodeDocumentLocks.java:39)
> at org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndModify(MongoDocumentStore.java:1054)
> at org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndUpdate(MongoDocumentStore.java:1610)
> at org.apache.jackrabbit.oak.plugins.document.util.LeaseCheckDocumentStoreWrapper.findAndUpdate(LeaseCheckDocumentStoreWrapper.java:151)
> at org.apache.jackrabbit.oak.plugins.document.Collision.markCommitRoot(Collision.java:201)
> at org.apache.jackrabbit.oak.plugins.document.Collision.mark(Collision.java:85)
> at org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:604)
> at org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:642)
> at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:372)
> at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStoreWithTiming(Commit.java:278)
> at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:262)
> at org.apache.jackrabbit.oak.plugins.document.Commit.applyInternal(Commit.java:236)
> at org.apache.jackrabbit.oak.plugins.document.Commit.apply(Commit.java:224)
> at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:321)
> at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:283)
> at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch$InMemory.merge(DocumentNodeStoreBranch.java:553)
> at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge0(DocumentNodeStoreBranch.java:197)
> at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge(DocumentNodeStoreBranch.java:121)
> at org.apache.jackrabbit.oak.plugins.document.DocumentRootBuilder.merge(DocumentRootBuilder.java:170)
> at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStore.merge(DocumentNodeStore.java:2067)
> at org.apache.jackrabbit.oak.composite.CompositeNodeStore.merge(CompositeNodeStore.java:153)
> at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:262)
> at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.cacheGroups(UserPrincipalProvider.java:318)
> at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getGroupMembership(UserPrincipalProvider.java:290)
> at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getPrincipals(UserPrincipalProvider.java:152)
> at org.apache.jackrabbit.oak.spi.security.principal.CompositePrincipalProvider.getPrincipals(CompositePrincipalProvider.java:104)
> at org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule.getPrincipals(AbstractLoginModule.java:573)
> at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule.commit(ExternalLoginModule.java:313)
> at org.apache.felix.jaas.boot.ProxyLoginModule.commit(ProxyLoginModule.java:57)
> {noformat}
> In case a group membership cache is stored at the principal, [some properties are updated on every access|https://github.com/apache/jackrabbit-oak/blob/dcb47fc0bcd4cce4e57c35fa844692544d9b4993/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java#L314], and committed. This leads to the situation, that every login to the repository results in commit to the nodestore, which I consider to be problematic for performance.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)