You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-issues@jackrabbit.apache.org by "Joerg Hoh (Jira)" <ji...@apache.org> on 2023/09/04 17:08:00 UTC
[jira] [Created] (OAK-10428) UserPrincipalProvider updates group cache on every login
Joerg Hoh created OAK-10428:
-------------------------------
Summary: UserPrincipalProvider updates group cache on every login
Key: OAK-10428
URL: https://issues.apache.org/jira/browse/OAK-10428
Project: Jackrabbit Oak
Issue Type: Task
Components: authorization-principalbased
Affects Versions: 1.56.0
Reporter: Joerg Hoh
Under traffic (by a single user) I see in a DocumentNodeStore setup this stacktrace for a lot of requests:
{noformat}
"qtp2052801890-41390" #41390 prio=5 os_prio=0 cpu=19882.72ms elapsed=3024.20s tid=0x0000564321465800 nid=0x3ec2a waiting on condition [0x00007f633f55f000]
java.lang.Thread.State: WAITING (parking)
at jdk.internal.misc.Unsafe.park(java.base@11.0.15/Native Method)
- parking to wait for <0x00000006a0cac5f0> (a java.util.concurrent.locks.ReentrantLock$NonfairSync)
at java.util.concurrent.locks.LockSupport.park(java.base@11.0.15/LockSupport.java:194)
at java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(java.base@11.0.15/AbstractQueuedSynchronizer.java:885)
at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireQueued(java.base@11.0.15/AbstractQueuedSynchronizer.java:917)
at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(java.base@11.0.15/AbstractQueuedSynchronizer.java:1240)
at java.util.concurrent.locks.ReentrantLock.lock(java.base@11.0.15/ReentrantLock.java:267)
at org.apache.jackrabbit.oak.plugins.document.locks.StripedNodeDocumentLocks.acquire(StripedNodeDocumentLocks.java:39)
at org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndModify(MongoDocumentStore.java:1054)
at org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndUpdate(MongoDocumentStore.java:1610)
at org.apache.jackrabbit.oak.plugins.document.util.LeaseCheckDocumentStoreWrapper.findAndUpdate(LeaseCheckDocumentStoreWrapper.java:151)
at org.apache.jackrabbit.oak.plugins.document.Collision.markCommitRoot(Collision.java:201)
at org.apache.jackrabbit.oak.plugins.document.Collision.mark(Collision.java:85)
at org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:604)
at org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:642)
at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:372)
at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStoreWithTiming(Commit.java:278)
at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:262)
at org.apache.jackrabbit.oak.plugins.document.Commit.applyInternal(Commit.java:236)
at org.apache.jackrabbit.oak.plugins.document.Commit.apply(Commit.java:224)
at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:321)
at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:283)
at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch$InMemory.merge(DocumentNodeStoreBranch.java:553)
at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge0(DocumentNodeStoreBranch.java:197)
at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge(DocumentNodeStoreBranch.java:121)
at org.apache.jackrabbit.oak.plugins.document.DocumentRootBuilder.merge(DocumentRootBuilder.java:170)
at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStore.merge(DocumentNodeStore.java:2067)
at org.apache.jackrabbit.oak.composite.CompositeNodeStore.merge(CompositeNodeStore.java:153)
at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:262)
at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.cacheGroups(UserPrincipalProvider.java:318)
at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getGroupMembership(UserPrincipalProvider.java:290)
at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getPrincipals(UserPrincipalProvider.java:152)
at org.apache.jackrabbit.oak.spi.security.principal.CompositePrincipalProvider.getPrincipals(CompositePrincipalProvider.java:104)
at org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule.getPrincipals(AbstractLoginModule.java:573)
at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule.commit(ExternalLoginModule.java:313)
at org.apache.felix.jaas.boot.ProxyLoginModule.commit(ProxyLoginModule.java:57)
{noformat}
In case a group membership cache is stored at the principal, [some properties are updated on every access|https://github.com/apache/jackrabbit-oak/blob/dcb47fc0bcd4cce4e57c35fa844692544d9b4993/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java#L314], and committed. This leads to the situation, that every login to the repository results in commit to the nodestore, which I consider to be problematic for performance.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)