[
https://issues.apache.org/jira/browse/OAK-5210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
angela updated OAK-5210:
------------------------
Attachment: sync_with_simplified_principal_resolution.txt
sync_with_roundtrip_delay_1_for_groups.txt
OAK-5210-benchmark.patch
attached a proposed patch for {{oak-run}} module introducing another benchmark
for external authentication. in order to be able to simulate the effect of the
simplified principal-name resolution from {{ExternalIdentityRef}} I added the
possibility to configure a delay for {{getIdentity}}, when it is a group.
also attached the profile/benchmark output for 2 options:
- delay = -1 => simplified resolution
- delay = 1 => delay upon group lookup as it is expected when a roundtrip is
involved.
the results should be considered exaggerated as i introduced no delay for the
user-lookup, which in a real scenario obviously also causes a round trip... but
they may indicated the a shortcut for the principal-lookup for groups actual
have an impact.
[~tripod], do you think this is a sensible interpretation?
in a final step, i would write more tests and also provide a patch for the
documentation to have the issue complete.
> Ability to resolve principal name from ExternalIdentityRef without IDP
> roundtrip
> --------------------------------------------------------------------------------
>
> Key: OAK-5210
> URL: https://issues.apache.org/jira/browse/OAK-5210
> Project: Jackrabbit Oak
> Issue Type: New Feature
> Components: auth-external
> Reporter: angela
> Assignee: angela
> Attachments: OAK-5210-benchmark.patch, OAK-5210-initialdraft.patch,
> sync_with_roundtrip_delay_1_for_groups.txt,
> sync_with_simplified_principal_resolution.txt
>
>
> Currently the only way to reliably determine the principal name for a given
> external identity is by calling {{ExternalIdentity.getPrincipalName()}}. This
> also means that there is currently no way to resolve the principal name from
> a given {{ExternalIdentityRef}}, without calling
> {{ExternalIdentityProvider.getIdentity(ExternalIdentityRef)}}.
> In the default sync mode a given identity-ref will always be resolved to the
> associated identity once a given identity is up for (re)sync and thus the
> identity resolution is part of the synchronization. On the other hand the
> partial sync as provided by the {{DynamicSyncContext}} doesn't require the
> resolution of group identities but only needs to be able to obtain the
> principal name, which is needed to proper populate the subject upon
> repository login (and for permission setup for those group principals). In
> this setup it would be preferrable if the principal name could be resolved
> from the {{ExternalIdentityRef}} without the intermediate identity resolution.
> This aim of this issue is to discuss the different options on how to achieve
> this improvement in a generic way that doesn't make any assumptions regarding
> the relationship between {{ExternalIdentity.getId}},
> {{ExternalIdentity.getPrincipalName}} and {{ExternalIdentityRef.getId}}.
> See also OAK-4930 and OAK-5200 for additional information.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
