<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <p>Hello Fréderic,</p>
    <p>good diagnostics!</p>
    <p>getDeputyAssignees is a method that should return all users that
      are entitled to play the role of a deputy of given user (with
      regards to approvals).</p>
    <p>It looks like it considered too many objects (26000+ users) when
      doing the search. <br>
    </p>
    <p>There are two possibilities:</p>
    <ol>
      <li>a bug in midPoint,</li>
      <li>some misconfiguration at your side.</li>
    </ol>
    <p>Could you find an entry of call 2255172 (i.e. "Entry: 2255172"
      string) and tell me what arguments of searchObjects call are?</p>
    <p>Then, have a look at any of the users returned, and look if it
      has "delegatedRef" filled in?</p>
    <p>Best regards,<br>
    </p>
    <pre class="moz-signature" cols="72">Pavol Mederly
Software developer
evolveum.com
</pre>
    <div class="moz-cite-prefix">On 24.10.2019 13:55, Frédéric Lohier
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CALRGK0pmHZ-_6hjCh0qOKjw4_E=CpGfB+5w6TZsLYO2=Kb4orA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="auto">
        <div dir="auto">
          <p style="font-size:12.8px;font-family:sans-serif">Hello
            Pavol,</p>
          <p style="font-size:12.8px;font-family:sans-serif"><br>
          </p>
          <p style="font-size:12.8px;font-family:sans-serif">Thank you
            for your input. I want further up in the profiling data (see
            attached file) starting at the
            ...model.impl.lens.Clockwork->authorizeRequest call which
            I guess is the start of the authorization process for add
            the “suborg TEST” organization.</p>
          <p style="font-size:12.8px;font-family:sans-serif">Then I get
            a bunch of “authorization 'authorization_name' in
            dummy:00000000-0000-0000-0000-000000000000(Authorization_rolename)
            not applicable for object because of” (from line 4 to 270)
            but my guess is these are not an issue.</p>
          <p style="font-size:12.8px;font-family:sans-serif">Then the
            case “Approving and executing creation of organization
            "suborg TEST"” is created (line 360), then I see
...model.impl.controller.ModelInteractionServiceImpl->getDeputyAssignees#
            (line 471) which might be culprit because shortly after
            that, I see :</p>
          <p style="font-size:12.8px;font-family:sans-serif"> </p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:08,733 DEBUG: ##### Exit: 2255172              
            ...repo.sql.SqlRepositoryServiceImpl->searchObjects#
            etime: 16847.160 ms</p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:08,865 TRACE: ###### retval:
[user:00000000-0000-0000-0000-000000000000(name),user:00000000-0000-0000-0000-000000000000(name)...26000+
            users]</p>
          <p style="font-size:12.8px;font-family:sans-serif"> </p>
          <p style="font-size:12.8px;font-family:sans-serif">which
            returned several thousands of user and lasted for more than
            16 seconds, and shortly after that (line 809), again another</p>
          <p style="font-size:12.8px;font-family:sans-serif"> </p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:15,333 DEBUG: ##### Exit: 2255170            
            ...repo.cache.RepositoryCache->searchObjects# etime:
            23446.578 ms</p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:15,510 TRACE: ###### retval:
[user:00000000-0000-0000-0000-000000000000(name),user:00000000-0000-0000-0000-000000000000(name)...26000+
            users]</p>
          <p style="font-size:12.8px;font-family:sans-serif"> </p>
          <p style="font-size:12.8px;font-family:sans-serif">Which
            lasted for more than 23 seconds. These 3 following lines
            seems to confirm that the getDepyutyAssignees is the issue
            (lines 823 to 827) :</p>
          <p style="font-size:12.8px;font-family:sans-serif"> </p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:16,907 DEBUG: ##### Exit: 2255169           
            ...model.api.ModelInteractionService->getDeputyAssignees
            etime: 25021.556 ms</p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:16,908 TRACE: ###### retval: {}</p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:16,908 DEBUG: ##### Exit: 2255168          
...model.impl.controller.ModelInteractionServiceImpl->getDeputyAssignees#
            etime: 25021.792 ms</p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:16,908 TRACE: ###### retval: []</p>
          <p style="font-size:12.8px;font-family:sans-serif">2019-10-21
            17:22:16,908 DEBUG: ##### Exit: 2255165         
            ...wf.impl.engine.actions.OpenStageAction->execute etime:
            25023.855 ms</p>
          <p style="font-size:12.8px;font-family:sans-serif"> </p>
          <p style="font-size:12.8px;font-family:sans-serif">Is this
            getDeputyAssignees normal for an approveRef?</p>
          <p style="font-size:12.8px;font-family:sans-serif">-Frederic</p>
        </div>
        <br>
        <div class="gmail_quote">
          <div dir="ltr" class="gmail_attr">On Tue, Oct 22, 2019, 19:04
            Pavol Mederly <<a href="mailto:mederly@evolveum.com"
              target="_blank" rel="noreferrer" moz-do-not-send="true">mederly@evolveum.com</a>>
            wrote:<br>
          </div>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div text="#000000" bgcolor="#FFFFFF">
              <p>Hello Fréderic,</p>
              <p>you are going in the right way. But you need to analyze
                the profiling data in more depth. E.g. it looks like the
                most interesting part is <i>before </i>the fragment
                you sent here.</p>
              Best regards,<br>
              <pre cols="72">Pavol Mederly
Software developer
<a href="http://evolveum.com" rel="noreferrer noreferrer" target="_blank" moz-do-not-send="true">evolveum.com</a>
</pre>
              <div>On 22.10.2019 18:46, Frédéric Lohier wrote:<br>
              </div>
              <blockquote type="cite">
                <div dir="auto">
                  <p
                    style="font-family:arial,sans-serif;font-size:small">Hello,</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">I
                    noticed a performance issue with approvals when the
                    approverRef references a group of user (Org or Role)
                    in a Midpoint instance with 20000+ users. My
                    approvals are specified in a globalPolicyRule in the
                    SystemConfiguration object.</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">When
                    I specifies the approverRef as below, the approval
                    request or the approval response each takes up to 30
                    seconds :</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"><approverRef
                    oid="00000000-0000-0000-0000-000000000000"
                    relation="org:default" type="c:OrgType"></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">Or</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"><approverRef
                    type="OrgType"></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">   <filter></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">     
                    <q:equal></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">        
                    <q:path>name</q:path></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">        
                    <q:value>Name of the org</q:value></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">      </q:equal></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">   </filter></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">  
                    <resolutionTime>run</resolutionTime></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </approverRef></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">If
                    I reduce the number of users in Midpoint, the
                    approval request/response gets faster.</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">On
                    the other hand, If I specify a static list of
                    approverRef like :</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"><approverRef
                    oid="00000000-0000-0000-0000-000000000000"
                    type="c:UserType"></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"><approverRef
                    oid="00000000-0000-0000-0000-000000000000"
                    type="c:UserType"></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">Or
                    a dynamic list of approvers through an
                    approverExpression like :</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"><approverExpression></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">  
                     <script></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">     
<code>midpoint.getMembersAsReferences("00000000-0000-0000-0000-000000000000")</code></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">  
                     </script></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"></approverExpression></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">Then ,
                    even with 20000+ users, the approval
                    request/response takes less than a second to be
                    processed.</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">For
                    reference, the full global policy rule :</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"><globalPolicyRule></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    <name>Delete user approvals</name></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    <policyConstraints></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">           
                    <modification></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">               
                    <operation>delete</operation></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">           
                    </modification></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    </policyConstraints></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    <policyActions></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">           
                    <approval></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">               
                    <approvalSchema></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                   
                    <stage></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                       
                    <approverRef
                    oid="00000000-0000-0000-0000-000000000000"
                    relation="org:default" type="c:OrgType"></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                       
                    <!-- Administrateurs Identités Arobas --></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                       
                    </approverRef></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> 
                                          <automaticallyCompleted></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                           
                    <description>If the user has the superuser
                    role, we automatically approve</description></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                           
                    <script></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                               
                    <code></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                
                                       if
                    (midpoint.isDirectlyAssigned(actor,
                    "00000000-0000-0000-0000-000000000004")) {</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                                       
                    return 'skip';</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                                   
                    }</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                                   
                    else {</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                  
                                         return null;</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                                   
                    }</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                               
                    </code></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                           
                    </script></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                       
                    </automaticallyCompleted></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">                   
                    </stage></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">               
                    </approvalSchema></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">           
                    </approval></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    </policyActions></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    <focusSelector></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">           
                    <type>UserType</type></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">       
                    </focusSelector></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">   
                    </globalPolicyRule></p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">An
                    excerpt of the trace:</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 DEBUG: ##### Exit: 2255272           
                    ...repo.cache.RepositoryCache->getObject# etime:
                    1.311 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 TRACE: ###### retval:
systemConfiguration:00000000-0000-0000-0000-000000000001(SystemConfiguration)</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 DEBUG: ##### Exit: 2255271          
...wf.impl.engine.helpers.NotificationHelper->sendPreparedNotifications
                    etime: 1.755 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 DEBUG: ##### Exit: 2255257         
                    ...wf.impl.engine.EngineInvocationContext->commit
                    etime: 40.146 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 DEBUG: ##### Exit: 2255157        
                    ...wf.impl.engine.WorkflowEngine->executeRequest
                    etime: 25067.345 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 DEBUG: ##### Exit: 2255136       
...wf.impl.processors.primary.PrimaryChangeProcessor->executeStartInstructions
                    etime: 25146.234 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 DEBUG: ##### Exit: 2255118      
...wf.impl.processors.primary.PrimaryChangeProcessor->previewOrProcessModelInvocation
                    etime: 25153.706 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,948 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: ##### Exit: 2255117     
                    ...wf.impl.hook.WfHook->invoke etime: 25153.876
                    ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: ##### Exit: 2254939    
                    ...model.impl.lens.Clockwork->click etime:
                    25198.070 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: #### Entry: 2255276   
...provisioning.impl.ProvisioningServiceImpl->exitConstraintsCheckerCache#</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 TRACE: ###### args: ()</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: ##### Exit: 2255276    
...provisioning.impl.ProvisioningServiceImpl->exitConstraintsCheckerCache#
                    etime: 0.012 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 TRACE: ###### retval: null</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: ##### Exit: 2254935   
                    ...model.impl.lens.Clockwork->run etime:
                    25198.487 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: ##### Exit: 2254934  
                    ...model.api.ModelService->executeChanges etime:
                    25198.728 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 TRACE: ###### retval: {}</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small">2019-10-21
                    17:22:16,949 DEBUG: ##### Exit: 2254933 
                    ...model.impl.controller.ModelController->executeChanges#
                    etime: 25201.841 ms</p>
                  <p
                    style="font-family:arial,sans-serif;font-size:small"> </p>
                </div>
                <br>
                <fieldset></fieldset>
                <pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" rel="noreferrer noreferrer" target="_blank" moz-do-not-send="true">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank" moz-do-not-send="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
              </blockquote>
            </div>
            _______________________________________________<br>
            midPoint mailing list<br>
            <a href="mailto:midPoint@lists.evolveum.com" rel="noreferrer
              noreferrer" target="_blank" moz-do-not-send="true">midPoint@lists.evolveum.com</a><br>
            <a
              href="http://lists.evolveum.com/mailman/listinfo/midpoint"
              rel="noreferrer noreferrer noreferrer" target="_blank"
              moz-do-not-send="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
          </blockquote>
        </div>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <pre class="moz-quote-pre" wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
    </blockquote>
  </body>
</html>