Groups of groups (and efficiency thereof)

[Peter Lister, Cranfield Computer Centre]

Those of you with long memories may remember discussing groups of
groups in July last year, when I asked Transarc to consider the
problem. The answers I got from most people seemed to try to tell me
that while GOGs might be nice from the management point of view, they
would slow the pt server unacceptably. This has been repeated recently

I don't agree. GOGs reduce system administration and should make the
protection database SMALLER and (if anything) FASTER.

It's a basic characteristic of efficient search algorithms that they
arrange items in trees so that search times depend on the log of the
number of elements. Please don't tell me that arranging my AFS users in
a sensible tree structure will make it significantly slower to use.

OK, so it's possible to have a build pathologically bad group structure
which would be slow to search, but I'm not going to do that, am I?
There's no point. Similarly, it would be possible for Transarc to
implement the above inefficiently, but I hope they wouldn't do that either.

Furthermore, the vast majority of our users are students whose activity
is almost solely within a particular group, department or school. In
terms of applying ACLs, they rarely exist as individuals. It makes no
sense to add individual users repeatedly to different groups for (say)
access to a particular package when they will only ever be managed in
bulk as part of their department or project group. Eliminating this
repetition makes a smaller database.

Yes, GOGs will probably require more work as each entry needs more
consistency checking as it is added to the db. BUT since the total
number of entrys in large groups will fall drastically, so will the
number of db additions. For large groups, this will drop from thousands
to dozens, so I'm quite happy with this tradeoff.

Anyone care to prove me wrong? Please, Transarc, we really need this,
and we can't hack AFS source like UMich.

Peter Lister                                    [EMAIL PROTECTED]
Computer Centre,
Cranfield Institute of Technology,        Voice: +44 234 754200 ext 2828
Cranfield, Bedfordshire MK43 0AL England    Fax: +44 234 750875