[OAK-10428] UserPrincipalProvider updates group cache on every login

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 1.56.0
• Component/s: authorization-principalbased
• Assignee: Unassigned
• Reporter: Joerg Hoh
• Created: 04/Sep/23 17:07
• Updated: 05/Sep/23 09:21
• Resolved: 04/Sep/23 17:13

Description

Under traffic (by a single user) I see in a DocumentNodeStore setup this stacktrace for a lot of requests:

"qtp2052801890-41390" #41390 prio=5 os_prio=0 cpu=19882.72ms elapsed=3024.20s tid=0x0000564321465800 nid=0x3ec2a waiting on condition  [0x00007f633f55f000]
   java.lang.Thread.State: WAITING (parking)
        at jdk.internal.misc.Unsafe.park(java.base@11.0.15/Native Method)
        - parking to wait for  <0x00000006a0cac5f0> (a java.util.concurrent.locks.ReentrantLock$NonfairSync)
        at java.util.concurrent.locks.LockSupport.park(java.base@11.0.15/LockSupport.java:194)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(java.base@11.0.15/AbstractQueuedSynchronizer.java:885)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireQueued(java.base@11.0.15/AbstractQueuedSynchronizer.java:917)
        at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(java.base@11.0.15/AbstractQueuedSynchronizer.java:1240)
        at java.util.concurrent.locks.ReentrantLock.lock(java.base@11.0.15/ReentrantLock.java:267)
        at org.apache.jackrabbit.oak.plugins.document.locks.StripedNodeDocumentLocks.acquire(StripedNodeDocumentLocks.java:39)
        at org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndModify(MongoDocumentStore.java:1054)
        at org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndUpdate(MongoDocumentStore.java:1610)
        at org.apache.jackrabbit.oak.plugins.document.util.LeaseCheckDocumentStoreWrapper.findAndUpdate(LeaseCheckDocumentStoreWrapper.java:151)
        at org.apache.jackrabbit.oak.plugins.document.Collision.markCommitRoot(Collision.java:201)
        at org.apache.jackrabbit.oak.plugins.document.Collision.mark(Collision.java:85)
        at org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:604)
        at org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:642)
        at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:372)
        at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStoreWithTiming(Commit.java:278)
        at org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:262)
        at org.apache.jackrabbit.oak.plugins.document.Commit.applyInternal(Commit.java:236)
        at org.apache.jackrabbit.oak.plugins.document.Commit.apply(Commit.java:224)
        at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:321)
        at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:283)
        at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch$InMemory.merge(DocumentNodeStoreBranch.java:553)
        at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge0(DocumentNodeStoreBranch.java:197)
        at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge(DocumentNodeStoreBranch.java:121)
        at org.apache.jackrabbit.oak.plugins.document.DocumentRootBuilder.merge(DocumentRootBuilder.java:170)
        at org.apache.jackrabbit.oak.plugins.document.DocumentNodeStore.merge(DocumentNodeStore.java:2067)
        at org.apache.jackrabbit.oak.composite.CompositeNodeStore.merge(CompositeNodeStore.java:153)
        at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:262)
        at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.cacheGroups(UserPrincipalProvider.java:318)
        at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getGroupMembership(UserPrincipalProvider.java:290)
        at org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getPrincipals(UserPrincipalProvider.java:152)
        at org.apache.jackrabbit.oak.spi.security.principal.CompositePrincipalProvider.getPrincipals(CompositePrincipalProvider.java:104)
        at org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule.getPrincipals(AbstractLoginModule.java:573)
        at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule.commit(ExternalLoginModule.java:313)
        at org.apache.felix.jaas.boot.ProxyLoginModule.commit(ProxyLoginModule.java:57)

In case a group membership cache is stored at the principal, some properties are updated on every access, and committed. This leads to the situation, that every login to the repository results in commit to the nodestore, which I consider to be problematic for performance.