[jira] [Created] (OAK-12341) Thread Contention authentication.external.impl.principal.SyncConfigTracker

["Patrique Legault (Jira)" <ji...@apache.org>]

Patrique Legault created OAK-12341:
--------------------------------------

             Summary: Thread Contention authentication.external.impl.principal.SyncConfigTracker
                 Key: OAK-12341
                 URL: https://issues.apache.org/jira/browse/OAK-12341
             Project: Jackrabbit Oak
          Issue Type: Bug
          Components: auth-external
            Reporter: Patrique Legault


When an external user needs to check permissions it requires requesting the OSGi services related to the external principal. This uses the [ServiceTracker|https://github.com/osgi/osgi/blob/8c7184dad43779668052afe5b29a2a201e527b52/org.osgi.util.tracker/src/org/osgi/util/tracker/ServiceTracker.java#L534-L541], which is a synchronized operation and should be used only when needed to prevent BLOCKING operations.

When the Oak repository is under heavy load and needs to perform permission looks up we can quickly flood the servlet container with BLOCKING permission lookups leading to slow operations.
{code:java}
java.lang.Thread.State: BLOCKED (on object monitor)
	at org.osgi.util.tracker.ServiceTracker.getServiceReferences(ServiceTracker.java:531)
	- waiting to lock <0x0000000206e9d158> (a org.osgi.util.tracker.ServiceTracker$Tracked)
	at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal.SyncConfigTracker.getReferences(SyncConfigTracker.java:166)
	at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal.SyncConfigTracker.isEnabled(SyncConfigTracker.java:59)
	at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal.ExternalPrincipalConfiguration.dynamicMembershipEnabled(ExternalPrincipalConfiguration.java:260)
	at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal.ExternalPrincipalConfiguration.getPrincipalProvider(ExternalPrincipalConfiguration.java:159)
	at org.apache.jackrabbit.oak.spi.security.principal.CompositePrincipalConfiguration.getPrincipalProvider(CompositePrincipalConfiguration.java:58)
	at org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.FilterProviderImpl.getFilter(FilterProviderImpl.java:104)
	at org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl.PrincipalBasedAuthorizationConfiguration.getPermissionProvider(PrincipalBasedAuthorizationConfiguration.java:127)
	at org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration.getPermissionProvider(CompositeAuthorizationConfiguration.java:181)
	at org.apache.jackrabbit.oak.core.MutableRoot$1.createValue(MutableRoot.java:135)
	at org.apache.jackrabbit.oak.core.MutableRoot$1.createValue(MutableRoot.java:132)
	at org.apache.jackrabbit.oak.commons.LazyValue.get(LazyValue.java:56)
	- locked <0x00000006f006f138> (a org.apache.jackrabbit.oak.core.MutableRoot$1)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:359)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.getTreePermission(SecureNodeBuilder.java:363)
	at org.apache.jackrabbit.oak.core.SecureNodeBuilder.exists(SecureNodeBuilder.java:128)
	at org.apache.jackrabbit.oak.plugins.tree.impl.AbstractTree.exists(AbstractTree.java:206)
	at org.apache.jackrabbit.oak.core.MutableTree.exists(MutableTree.java:120)
{code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)