[OAK-4920] DefaultSyncHandler.listIdentities() search too broad, triggers traversal warning

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.8, 1.5.11
• Fix Version/s: 1.7.0, 1.8.0
• Component/s: auth-external
• Labels: performance
• Assignee: Angela Schreiber
• Reporter: Alexander Klimetschek
• Created: 11/Oct/16 05:57
• Updated: 30/May/17 08:38
• Resolved: 06/Mar/17 13:07

Description

DefaultSyncHandler.listIdentities() collects users by searching for all nodes under /home – the xpath query executed is

/jcr:root/home//element(*)[@jcr:primaryType]

With a few hundred users this easily gives an oak index traversal warning:

org.apache.jackrabbit.oak.spi.query.Cursors$TraversingCursor Traversed 1000 nodes with filter Filter(query=select [jcr:path], [jcr:score], * from [nt:base] as a where [jcr:primaryType] is not null and isdescendantnode(a, '/home') /* xpath: /jcr:root/home//element(*)[@jcr:primaryType] */, path=/home//*, property=[jcr:primaryType=[is not null]]); consider creating an index or changing the query

A few lines later it actually reduces the result to authorizables which have a rep:externalId. Since OAK-4301 there is an oak index for rep:externalId, so the query can be optimized by searching for anything with rep:externalId instead:

userManager.findAuthorizables("rep:externalId", null);

Issue Links

• is related to: OAK-5743 UserQueryManager: omits nt-name when searching for properties without path deliminator
• is related to: OAK-5689 AbstractSecurityTest: enforce test-failure for traversal queries
• is related to: OAK-5785 JCR tests: enforce failure upon query traversal
• relates to: OAK-5892 ResultRowToAuthorizable: create user/group from tree