[Rt-devel] Why are Groups cachedmembers of themselves?

[Jesse Vincent]

On Thu, Nov 02, 2006 at 11:45:34AM -0800, Joby Walker wrote:
> Jesse,
> 
> I've pushed the below changes to our dev system and purged the duplicate 
> cachedgroupmember records -- we haven't come across a problem yet. 
> Doing so dropped the size of the cachedgroupmember table by more than 
> 2/3!  In our production system (currently) this will mean a drop of 65% 
> (833,989 records to 288,706).

That's excellent news. I regret that I haven't had time to look into
your fix with the care and attention I really want to give it. The size
of the CachedGroupMembers table has frustrated me for a long time.  I do
appreciate the hard work :)

> 
> Joby Walker
> C&C SSG, University of Washington
> 
> 
> Joby Walker wrote:
> >Jesse Vincent wrote:
> >>>So why is this necessary?  Is it for ACL checks on User Defined groups?
> >>
> >>It's for ~all group ACL and groupmember checks.
> >>
> >
> >Ok, it took me a while to see where the cachedgroupmember record is 
> >necessary: When you make a check to see if a group has the ACL to do X 
> >(exactly what you said).
> >
> >The impact of adding hundreds of thousands of additional records seems 
> >like a very high cost to be able to do these group queries just like 
> >user permission queries.
> >
> >I grabbed a fresh rt-3.4.4 (what we currently use) and Modified the 
> >following:
> >
> >RT::Group_Overlay->_Create()
> >
> >comment out line 511,512 where the group is added as a cached member of 
> >itself.
> >
> >RT::Principal_Overlay->HasRight()
> >
> >Add on line 401 (just before the "Build that honkin-big SQL query") a 
> >check that if the Principal is a Group to determine if that group has a 
> >specific ACL.
> >
> >    if ($self->IsGroup) {
> >    my $qb = 'SELECT ACL.id from ACL, Principals WHERE'
> >            ." ( ACL.RightName = 'SuperUser' OR ACL.RightName = '$right' 
> >) "
> >        ."AND Principals.Disabled = 0 "
> >        ."AND Principals.id = " . $self->Id . " "
> >        ."AND Principals.id = ACL.principalid "
> >        ."AND ( " . join( ' OR ', @look_at_objects ). ") ";
> >        $self->_Handle->ApplyLimits( \$qb, 1 );
> >        my $hitcount = $self->_Handle->FetchResult($qb);
> >    if ($hitcount) {
> >            return (1);
> >        }
> >    }
> >
> >
> >With these two changes all of the regression tests pass.
> >
> >Joby Walker
> >C&C SSG, University of Washington
> >_______________________________________________
> >List info: http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-devel
> 

--