Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (nike.apache.org: domain of elecharny@gmail.com designates
 209.85.161.50 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:reply-to:user-agent:mime-version:to:subject
         :content-type:content-transfer-encoding;
        b=E8g+KHF6FWf0bcwRUw17TKHFJpW3zoI+6iEzq8tZeVyuVSBYmm6LwFli4/Rn6vs/g/
         MvIrYjCX/5CCyUWSegALm7BPpeElA55eZwlhxa8OcdIf4wqV6cTUYUP8IuvGI6/fxW0Y
         fqvd4c5PGNHnLYllDLMBx/XktyrgttB7Lr0zs=
Message-ID: <4C3257D6.9020306@gmail.com>
Date: Tue, 06 Jul 2010 00:08:22 +0200
From: Emmanuel Lecharny <elecharny@gmail.com>
Reply-To: elecharny@apache.org
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
 rv:1.9.2.4) Gecko/20100608 Thunderbird/3.1
MIME-Version: 1.0
To: Apache Directory Developers List <dev@directory.apache.org>
Subject: ACI and subtrees interactions
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

  Hi,

I'm just checking the subentryInterceptor while trying to find the best 
way to fix the ACI handling when the server is stopped and restarted.

There is something really unpleasant in this interceptor : when adding a 
subtree, we do a search in the DIT to find all the entries part of the 
subtree, and each of them is modified to have the 
accessControlSubentries AT added, with a reference to the subentry.

If the server contains millions of enries, this is simply not an option.

The direct consequence is that anytime we add an ACI which span over a 
lot of entries, we wwill have a large number of modifications applied, 
and it's definitively a costly operation (moreover, I don't see how we 
can assure the atomicity of such an operation...)

We have to find a better way to determinate if an entry is part of a 
subtree than by modifying this entry.

Another annoying aspect is that when we evaluate an ACI, we have to get 
the subtree from the subEntry interceptor, because the associated cache 
is not global. This is not a good thing too. Caches must be handled 
globally by the DirectoryService instance, not by each interceptors.

Still a lot of work before we can release a production ready server, 
guys...

-- 
Regards,
Cordialement,
Emmanuel L�charny
www.iktek.com