[jira] [Commented] (OAK-4920) Performance: DefaultSyncHandler.listIdentities() search too broad, triggers traversal warning

["angela (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OAK-4920?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15818610#comment-15818610 ] 

angela commented on OAK-4920:
-----------------------------

I gave it a try changing the query to look for existence of {{rep:externalId}} both using {{UserManager.findAuthorizables(Query)}} and {{UserManager.findAuthorizables(String, String)}} including a benchmark to verify the result. In contrast to the explanation above both queries resulted in a traversal, which I additionally verified in an Oak setup that has the {{oak-auth-external}} included by default including the {{externalId}} index definition: also in that installation running a query-analysis tool revealed that they will cause a traversal; the reason for this is that the user management queries limit the query scope to the tree containing authorizables, while the index doesn't apply this restriction to ensure global uniqueness of this system maintained property.

So, a bit more effort required to address this... will continue investigating.

> Performance: DefaultSyncHandler.listIdentities() search too broad, triggers traversal warning
> ---------------------------------------------------------------------------------------------
>
>                 Key: OAK-4920
>                 URL: https://issues.apache.org/jira/browse/OAK-4920
>             Project: Jackrabbit Oak
>          Issue Type: Improvement
>          Components: auth-external
>    Affects Versions: 1.4.8, 1.5.11
>            Reporter: Alexander Klimetschek
>            Assignee: angela
>             Fix For: 1.8
>
>
> DefaultSyncHandler.listIdentities() collects users by [searching for all nodes under /home|https://github.com/apache/jackrabbit-oak/blob/b3e62e3467bf6433b5a419c2f371331f33e57820/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DefaultSyncHandler.java#L143] – the xpath query executed is
> {noformat}
> /jcr:root/home//element(*)[@jcr:primaryType]
> {noformat}
> With a few hundred users this easily gives an oak index traversal warning:
> {noformat}
> org.apache.jackrabbit.oak.spi.query.Cursors$TraversingCursor Traversed 1000 nodes with filter Filter(query=select [jcr:path], [jcr:score], * from [nt:base] as a where [jcr:primaryType] is not null and isdescendantnode(a, '/home') /* xpath: /jcr:root/home//element(*)[@jcr:primaryType] */, path=/home//*, property=[jcr:primaryType=[is not null]]); consider creating an index or changing the query
> {noformat}
> A few lines later [it actually reduces|https://github.com/apache/jackrabbit-oak/blob/b3e62e3467bf6433b5a419c2f371331f33e57820/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DefaultSyncHandler.java#L151] the result to authorizables which have a {{rep:externalId}}. Since OAK-4301 there is an oak index for {{rep:externalId}}, so the query can be optimized by searching for anything with {{rep:externalId}} instead:
> {code:java}
> userManager.findAuthorizables("rep:externalId", null);
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)