[OAK-3003] Improve login performance with huge group membership

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.19, 1.3.4, 1.4
• Component/s: core
• Labels: performance
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 17/Jun/15 07:46
• Updated: 18/Aug/16 13:17
• Resolved: 11/Aug/15 07:41

Description

As visible when running LoginWithMembershipTest default login performance (which uses the o.a.j.oak.security.principal.PrincipalProviderImpl to lookup the complete set of principals) suffers when a given user is member of a huge number of groups (see also OAK-2690 for benchmark data).

While using dynamic group membership (and thus a custom PrincipalProvider would be the preferable way to deal with this, we still want to optimize PrincipalProvider.getPrincipals(String userId for the default implementation.

With the introduction of a less generic implementation in OAK-2690, we might be able to come up with an optimization that makes use of the very implementation details of the user management while at the same time being able to properly secure it as we won't need to extend the public API.

Issue Links

• is duplicated by: OAK-2773 Speed up creation of JCR sessions
• requires: OAK-2690 Add optional UserConfiguration#getUserPrincipalProvider()