[
https://issues.apache.org/jira/browse/OAK-10428?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17761997#comment-17761997
]
Marcel Reutegger edited comment on OAK-10428 at 9/5/23 9:08 AM:
----------------------------------------------------------------
bq. In case a group membership cache is stored at the principal, some
properties are updated on every access, and committed.
I noticed this as well in some cases, but the cache is not updated on every
access. There is still a problematic pattern in my view. Once the cache for a
principal reaches the end of its TTL, there is a thundering herd problem.
Multiple requests coming in at roughly the same time will all try to update the
cache and most of them will run into conflicts.
I think it would be better if only one thread updates the cache, while all
other just use the slightly outdated value currently in the cache.
was (Author: mreutegg):
bq. In case a group membership cache is stored at the principal, some
properties are updated on every access, and committed.
I noticed this as well in some cases, but the cache is not updated on every
access. There is still a problematic pattern in my view. Once the cache for a
principal reaches the end of its TTL, there is a thundering herd problem.
Multiple requests coming in at roughly the same time will all try to update the
cache and most of them will run into conflicts.
> UserPrincipalProvider updates group cache on every login
> --------------------------------------------------------
>
> Key: OAK-10428
> URL: https://issues.apache.org/jira/browse/OAK-10428
> Project: Jackrabbit Oak
> Issue Type: Task
> Components: authorization-principalbased
> Affects Versions: 1.56.0
> Reporter: Joerg Hoh
> Priority: Major
>
> Under traffic (by a single user) I see in a DocumentNodeStore setup this
> stacktrace for a lot of requests:
> {noformat}
> "qtp2052801890-41390" #41390 prio=5 os_prio=0 cpu=19882.72ms elapsed=3024.20s
> tid=0x0000564321465800 nid=0x3ec2a waiting on condition [0x00007f633f55f000]
> java.lang.Thread.State: WAITING (parking)
> at jdk.internal.misc.Unsafe.park(java.base@11.0.15/Native Method)
> - parking to wait for <0x00000006a0cac5f0> (a
> java.util.concurrent.locks.ReentrantLock$NonfairSync)
> at
> java.util.concurrent.locks.LockSupport.park(java.base@11.0.15/LockSupport.java:194)
> at
> java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(java.base@11.0.15/AbstractQueuedSynchronizer.java:885)
> at
> java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireQueued(java.base@11.0.15/AbstractQueuedSynchronizer.java:917)
> at
> java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(java.base@11.0.15/AbstractQueuedSynchronizer.java:1240)
> at
> java.util.concurrent.locks.ReentrantLock.lock(java.base@11.0.15/ReentrantLock.java:267)
> at
> org.apache.jackrabbit.oak.plugins.document.locks.StripedNodeDocumentLocks.acquire(StripedNodeDocumentLocks.java:39)
> at
> org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndModify(MongoDocumentStore.java:1054)
> at
> org.apache.jackrabbit.oak.plugins.document.mongo.MongoDocumentStore.findAndUpdate(MongoDocumentStore.java:1610)
> at
> org.apache.jackrabbit.oak.plugins.document.util.LeaseCheckDocumentStoreWrapper.findAndUpdate(LeaseCheckDocumentStoreWrapper.java:151)
> at
> org.apache.jackrabbit.oak.plugins.document.Collision.markCommitRoot(Collision.java:201)
> at
> org.apache.jackrabbit.oak.plugins.document.Collision.mark(Collision.java:85)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:604)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.checkConflicts(Commit.java:642)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:372)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStoreWithTiming(Commit.java:278)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.applyToDocumentStore(Commit.java:262)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.applyInternal(Commit.java:236)
> at
> org.apache.jackrabbit.oak.plugins.document.Commit.apply(Commit.java:224)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:321)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.persist(DocumentNodeStoreBranch.java:283)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch$InMemory.merge(DocumentNodeStoreBranch.java:553)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge0(DocumentNodeStoreBranch.java:197)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentNodeStoreBranch.merge(DocumentNodeStoreBranch.java:121)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentRootBuilder.merge(DocumentRootBuilder.java:170)
> at
> org.apache.jackrabbit.oak.plugins.document.DocumentNodeStore.merge(DocumentNodeStore.java:2067)
> at
> org.apache.jackrabbit.oak.composite.CompositeNodeStore.merge(CompositeNodeStore.java:153)
> at
> org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:262)
> at
> org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.cacheGroups(UserPrincipalProvider.java:318)
> at
> org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getGroupMembership(UserPrincipalProvider.java:290)
> at
> org.apache.jackrabbit.oak.security.user.UserPrincipalProvider.getPrincipals(UserPrincipalProvider.java:152)
> at
> org.apache.jackrabbit.oak.spi.security.principal.CompositePrincipalProvider.getPrincipals(CompositePrincipalProvider.java:104)
> at
> org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule.getPrincipals(AbstractLoginModule.java:573)
> at
> org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule.commit(ExternalLoginModule.java:313)
> at
> org.apache.felix.jaas.boot.ProxyLoginModule.commit(ProxyLoginModule.java:57)
> {noformat}
> In case a group membership cache is stored at the principal, [some properties
> are updated on every
> access|https://github.com/apache/jackrabbit-oak/blob/dcb47fc0bcd4cce4e57c35fa844692544d9b4993/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java#L314],
> and committed. This leads to the situation, that every login to the
> repository results in commit to the nodestore, which I consider to be
> problematic for performance.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
