[jira] [Created] (OAK-4090) Consider decoupling of group-sync from repository login

["angela (JIRA)" <ji...@apache.org>]

angela created OAK-4090:
---------------------------

             Summary: Consider decoupling of group-sync from repository login
                 Key: OAK-4090
                 URL: https://issues.apache.org/jira/browse/OAK-4090
             Project: Jackrabbit Oak
          Issue Type: Task
          Components: auth-external
            Reporter: angela


currently the success of the login using {{ExternalLoginModule}} is tied to the completion of the user-synchronization which (may) also include sync of group membership. consequently performance of the repository login is always limited by the performance of write operations which in the case of group-sync is in any case expensive (irrespective on how much improvement we achieve with OAK-3933).

i would therefore like to the suggest that we consider if and how we could decouple the sync-mechanism from the login step. this could for example include async processing of the group-membership. this would also require to make sure that the initial as well as all subsequent login operations properly populate the subject with principals of type {{java.security.acl.Group}} i.e. not relying on the principal-membership being reflected in the user-management until the sync is not completed.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)