Skip to Content.
Sympa Menu

grouper-users - [grouper-users] RE: [JIRA] (GRP-1446) performance of the Trace Privileges function

Subject: Grouper Users - Open Discussion List

List archive

[grouper-users] RE: [JIRA] (GRP-1446) performance of the Trace Privileges function

Chronological Thread 
  • From: "Hyzer, Chris" <>
  • To: " Mailing List" <>
  • Subject: [grouper-users] RE: [JIRA] (GRP-1446) performance of the Trace Privileges function
  • Date: Thu, 29 Dec 2016 22:28:58 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:h6fGfBJZIopbvhW2bNmcpTZWNBhigK39O0sv0rFitYgfLfrxwZ3uMQTl6Ol3ixeRBMOAuq4C07ed6/yocFdDyK7JiGoFfp1IWk1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZrKeTpAI7SiNm82/yv95HJbQhFgDWwbaluIBi2ogndqsYbipZ+J6gszRfEvmFGcPlMy2NyIlKTkRf85sOu85Nm7i9dpfEv+dNeXKvjZ6g3QqBWAzogM2Au+c3krgLDQheV5nsdSWoZjBxFCBXY4R7gX5fxtiz6tvdh2CSfIMb7Q6w4VSik4qx2ThLjlSUJOCMj8GzPisJ+kr9VoA6vqRJ8zY7bYoCVO+ZxcKzSZt4aWXFOUtpNWyBdHo+xbY0CBPcBM+ZCqIn9okMDoRW8CwisBeLg1CVIimfr1qAk0+QhCwDG3BcuE9kTt3nUqcn6NKcSUOG00qbI1y7Ob/JN2Tjh8oTIbwghru+KXbJ2a8be11QgFx7cg1iWtIfrMTSV1uEXvGia6eptTeOvi2g7qw5vuDivwNkjipXXio4P1F/L6Dh5zJ46Jd25VE57YcOkH4BKuy6GMIt2R8UvSHxrtiYi0rAKp4S0cDQXxJki2hLTduGLfo2G4h/sSOqdPTJ1iXB7d7+wmhq/9E2txvPgWsWpyFpGsyRInsXWun0JyhDf8NaLRuZ580u7xDqC1QHe5+dZKk4uj6XbMYQuwrsom5oTr0vDGij2lV3ugqKKcUso5vWk5/36b7v+qJKQLoh0hRrgPag0ncy/HPg4PRMJX2iG/+Szyafv/VXjQLVNkv05jLXWsIzbJcQcoK61GQhV0ps/6xa7CDem19cYkWMbI1JCfRKLl4npO1fQL/DkFfqznU6jnCt2y/3DI7HtH4jBI33NkLruYbpx90tRxQgtwt1Q+p5ZD7QMLOzvVkPsrNDYCwU2Mw2ww+bpEtV90YYeVHqKAqCFMKPTsV6J6fw1I+SXZY8VoyryJ+I45/72k3A5n1kdcbO30pQKdXC0Bu5mLFmBYXrwntcBFn8HvgUkTOztlV2CSSBcZ2yrU6Ih/TE0FpimDZzYS4CpgbyBxzu7HoZIamxcC1CMF2voeJueW/cKdi2SPtFtniYaWre8Vo9ynS2p4UX10b16NufOvzADuIj4/Nlz++DJkxwur3p5A9nV9miMS2BykSssRiQqlugrrlZ610+Oy+1lmPFCDvRS4e9ESAE3KcSawuBnXYPcQAXEK52pWUSrWJHuKjErT8l7i4sLaEZsCdi4phHY1Gy3G7ITkfqGCIFiofGU5GT4O8sokyWO76ImlVRzGsY=
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Chad, this is fixed in API patch #38. Can you please try it and let me know
how it goes?


-----Original Message-----
From: Chad Redman (JIRA)

Sent: Wednesday, December 21, 2016 3:27 PM
To: Hyzer, Chris
Subject: [JIRA] (GRP-1446) performance of the Trace Privileges function

Chad Redman created GRP-1446:

Summary: performance of the Trace Privileges function
Key: GRP-1446
Project: Grouper
Issue Type: Improvement
Components: API, UI
Affects Versions: 2.3.0
Reporter: Chad Redman
Assignee: Chris Hyzer

The Trace Privileges function in the group privileges tab is performing badly
for us. Tracing through the source code, I see that when the user doesn't
have one of the privileges (it loops through all 8 of them individually,
first as the user, then as EveryEntity), further queries are not being
circumvented. Instead, the subsequent query, to ensure the UI session user
can view the groups in the path, is being called with a empty list of groups.
This results in the query returning every group/role in the database, then
creating a set of Group objects for them, which is never used. Privilege
tracing is called twice, once for the subject and once for EveryEntity, so
the performance hit could happen from either one of them.

I tested a quick circumvention check in the MembershipGroupPath class, and
that does improve it. I had thought about just early exiting when the use has
no privilege. But later parts of the code do queries on other user
relationships, and it was complex enough that I didn't want to assume it
wouldn't pull in anything that could be safely shorted.

From 35b57ccf135390bf366c59aa30ca558f05524729 Mon Sep 17 00:00:00 2001
From: Chad Redman
Date: Tue, 20 Dec 2016 17:28:03 -0500
Subject: [PATCH] improve performance of privilege path tracer

.../internet2/middleware/grouper/membership/ | 5
1 file changed, 5 insertions(+)

diff --git

index ed26cf6..779c97e 100644
@@ -949,6 +949,11 @@ public class MembershipPathGroup {
public Object callback(GrouperSession grouperSession) throws
GrouperSessionException {

+ //if there is no traced path, don't call groupFinder -- with no
groupIds it will return all groups
+ if (GrouperUtil.length(groupIds) == 0) {
+ return new HashSet<Group>();
+ }
GroupFinder groupFinder = new
//this is read since it is more about the groups in groups as members


This message was sent by Atlassian JIRA

  • [grouper-users] RE: [JIRA] (GRP-1446) performance of the Trace Privileges function, Hyzer, Chris, 12/29/2016

Archive powered by MHonArc 2.6.19.

Top of Page