Subject.isPermitted(List permissions) hitting the cache for every permission.

[brndmg <mc...@gmail.com>]

Should the isPermitted(List<Permission> permissions) be hitting the cache for
every permission in the list?

>From the docs it states that "This is primarily a performance-enhancing
method to help reduce the number of isPermitted(java.lang.String)
invocations over the wire in client/server systems."

If our cache is on redis, this is definitely not a reduction in
"over-the-wire" requests.

Is our implementation flawed, or is this expected behavior?

Thanks,
Matt S.



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Subject-isPermitted-List-Permission-permissions-hitting-the-cache-for-every-permission-tp7580357.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Subject.isPermitted(List permissions) hitting the cache for every permission.

[mickepicke <mi...@maxm.se>]

Hi,

Sorry for waking this old thread!

> It depends on the realm implementation

I don't think it's entirely true that this is up to the Realm
implementations. 

org.apache.shiro.authz.ModularRealmAuthorizer has several "isPermitted"
methods that accept collections of permissions to check. But all of them
have loops that call into the non-batch counterparts in the realms – so the
realms never get a chance to do any sort of batch processing. I believe that
the correct behavior would be to for ModularRealmAuthorizer to call one of
the batch methods on each of the realms and merge the resulting boolean
arrays. This can be achieved by subclassing ModularRealmAuthorizer (which
I've done), but I believe that it's a bug that should be fixed.





--
View this message in context: http://shiro-user.582556.n2.nabble.com/Subject-isPermitted-List-Permission-permissions-hitting-the-cache-for-every-permission-tp7580357p7580541.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Subject.isPermitted(List permissions) hitting the cache for every permission.

[Les Hazlewood <lh...@apache.org>]

Hi Matt,

It depends on the realm implementation.  By default, the out-of-the-box
realms will hit the cache if enabled (because that's usually better than a
round trip to a traditional data store per check).  For more targeted
performance enhancements, a Realm implementation could send all permission
strings to a data store to be checked all at once and get a single
result/answer, or maybe even use a tiered cache approach (local in-memory
first, then network cache, then finally the data store).

There is no multi-tiered cache approach within Shiro today, but it'd be
easy enough to implement: A CacheManager implementation would return Cache
instances that just 'wrap' two caches: a local in-memory one and then falls
back to the networked one.

That said, if you have any improvements or suggestions, we're open to
them!  Do you have an idea of how you'd like this to work for the
out-of-the-box realm implementations?

HTH,

--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282

On Tue, Dec 9, 2014 at 6:02 AM, brndmg <mc...@gmail.com> wrote:

> Should the isPermitted(List<Permission> permissions) be hitting the cache
> for
> every permission in the list?
>
> From the docs it states that "This is primarily a performance-enhancing
> method to help reduce the number of isPermitted(java.lang.String)
> invocations over the wire in client/server systems."
>
> If our cache is on redis, this is definitely not a reduction in
> "over-the-wire" requests.
>
> Is our implementation flawed, or is this expected behavior?
>
> Thanks,
> Matt S.
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Subject-isPermitted-List-Permission-permissions-hitting-the-cache-for-every-permission-tp7580357.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>