<div dir="auto">Hello Pavol,<div dir="auto"><br></div><div dir="auto">Thank you!</div><div dir="auto"><br></div><div dir="auto">Here is the entry : </div><div dir="auto"><br></div><div dir="auto"><p style="font-family:sans-serif;font-size:12.8px">2019-10-21 17:21:51,886 DEBUG: #### Entry: 2255172 ...repo.sql.SqlRepositoryServiceImpl->searchObjects#<u></u><u></u></p><p style="font-family:sans-serif;font-size:12.8px">2019-10-21 17:21:51,886 TRACE: ###### args: (UserType, Q{REF: delegatedRef,,null paging, null, R(com.evolveum.midpoint.repo.cache.RepositoryCache.searchObjects UNKNOWN null))</p><p style="font-family:sans-serif;font-size:12.8px"><br></p><p style="">For what it's worth, I have a read authorization on the delegatedRef item of UserType.</p><p style=""><br></p><p style="">-Frederic</p><p style="font-family:sans-serif;font-size:12.8px"><br></p></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 24, 2019, 16:57 Pavol Mederly <<a href="mailto:mederly@evolveum.com">mederly@evolveum.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>Hello Fréderic,</p>
<p>good diagnostics!</p>
<p>getDeputyAssignees is a method that should return all users that
are entitled to play the role of a deputy of given user (with
regards to approvals).</p>
<p>It looks like it considered too many objects (26000+ users) when
doing the search. <br>
</p>
<p>There are two possibilities:</p>
<ol>
<li>a bug in midPoint,</li>
<li>some misconfiguration at your side.</li>
</ol>
<p>Could you find an entry of call 2255172 (i.e. "Entry: 2255172"
string) and tell me what arguments of searchObjects call are?</p>
<p>Then, have a look at any of the users returned, and look if it
has "delegatedRef" filled in?</p>
<p>Best regards,<br>
</p>
<pre cols="72">Pavol Mederly
Software developer
<a href="http://evolveum.com" target="_blank" rel="noreferrer">evolveum.com</a>
</pre>
<div>On 24.10.2019 13:55, Frédéric Lohier
wrote:<br>
</div>
<blockquote type="cite">
<div dir="auto">
<div dir="auto">
<p style="font-size:12.8px;font-family:sans-serif">Hello
Pavol,</p>
<p style="font-size:12.8px;font-family:sans-serif"><br>
</p>
<p style="font-size:12.8px;font-family:sans-serif">Thank you
for your input. I want further up in the profiling data (see
attached file) starting at the
...model.impl.lens.Clockwork->authorizeRequest call which
I guess is the start of the authorization process for add
the “suborg TEST” organization.</p>
<p style="font-size:12.8px;font-family:sans-serif">Then I get
a bunch of “authorization 'authorization_name' in
dummy:00000000-0000-0000-0000-000000000000(Authorization_rolename)
not applicable for object because of” (from line 4 to 270)
but my guess is these are not an issue.</p>
<p style="font-size:12.8px;font-family:sans-serif">Then the
case “Approving and executing creation of organization
"suborg TEST"” is created (line 360), then I see
...model.impl.controller.ModelInteractionServiceImpl->getDeputyAssignees#
(line 471) which might be culprit because shortly after
that, I see :</p>
<p style="font-size:12.8px;font-family:sans-serif"> </p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:08,733 DEBUG: ##### Exit: 2255172
...repo.sql.SqlRepositoryServiceImpl->searchObjects#
etime: 16847.160 ms</p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:08,865 TRACE: ###### retval:
[user:00000000-0000-0000-0000-000000000000(name),user:00000000-0000-0000-0000-000000000000(name)...26000+
users]</p>
<p style="font-size:12.8px;font-family:sans-serif"> </p>
<p style="font-size:12.8px;font-family:sans-serif">which
returned several thousands of user and lasted for more than
16 seconds, and shortly after that (line 809), again another</p>
<p style="font-size:12.8px;font-family:sans-serif"> </p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:15,333 DEBUG: ##### Exit: 2255170
...repo.cache.RepositoryCache->searchObjects# etime:
23446.578 ms</p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:15,510 TRACE: ###### retval:
[user:00000000-0000-0000-0000-000000000000(name),user:00000000-0000-0000-0000-000000000000(name)...26000+
users]</p>
<p style="font-size:12.8px;font-family:sans-serif"> </p>
<p style="font-size:12.8px;font-family:sans-serif">Which
lasted for more than 23 seconds. These 3 following lines
seems to confirm that the getDepyutyAssignees is the issue
(lines 823 to 827) :</p>
<p style="font-size:12.8px;font-family:sans-serif"> </p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:16,907 DEBUG: ##### Exit: 2255169
...model.api.ModelInteractionService->getDeputyAssignees
etime: 25021.556 ms</p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:16,908 TRACE: ###### retval: {}</p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:16,908 DEBUG: ##### Exit: 2255168
...model.impl.controller.ModelInteractionServiceImpl->getDeputyAssignees#
etime: 25021.792 ms</p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:16,908 TRACE: ###### retval: []</p>
<p style="font-size:12.8px;font-family:sans-serif">2019-10-21
17:22:16,908 DEBUG: ##### Exit: 2255165
...wf.impl.engine.actions.OpenStageAction->execute etime:
25023.855 ms</p>
<p style="font-size:12.8px;font-family:sans-serif"> </p>
<p style="font-size:12.8px;font-family:sans-serif">Is this
getDeputyAssignees normal for an approveRef?</p>
<p style="font-size:12.8px;font-family:sans-serif">-Frederic</p>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Oct 22, 2019, 19:04
Pavol Mederly <<a href="mailto:mederly@evolveum.com" rel="noreferrer noreferrer" target="_blank">mederly@evolveum.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>Hello Fréderic,</p>
<p>you are going in the right way. But you need to analyze
the profiling data in more depth. E.g. it looks like the
most interesting part is <i>before </i>the fragment
you sent here.</p>
Best regards,<br>
<pre cols="72">Pavol Mederly
Software developer
<a href="http://evolveum.com" rel="noreferrer noreferrer noreferrer" target="_blank">evolveum.com</a>
</pre>
<div>On 22.10.2019 18:46, Frédéric Lohier wrote:<br>
</div>
<blockquote type="cite">
<div dir="auto">
<p style="font-family:arial,sans-serif;font-size:small">Hello,</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">I
noticed a performance issue with approvals when the
approverRef references a group of user (Org or Role)
in a Midpoint instance with 20000+ users. My
approvals are specified in a globalPolicyRule in the
SystemConfiguration object.</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">When
I specifies the approverRef as below, the approval
request or the approval response each takes up to 30
seconds :</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small"><approverRef
oid="00000000-0000-0000-0000-000000000000"
relation="org:default" type="c:OrgType"></p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">Or</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small"><approverRef
type="OrgType"></p>
<p style="font-family:arial,sans-serif;font-size:small"> <filter></p>
<p style="font-family:arial,sans-serif;font-size:small">
<q:equal></p>
<p style="font-family:arial,sans-serif;font-size:small">
<q:path>name</q:path></p>
<p style="font-family:arial,sans-serif;font-size:small">
<q:value>Name of the org</q:value></p>
<p style="font-family:arial,sans-serif;font-size:small"> </q:equal></p>
<p style="font-family:arial,sans-serif;font-size:small"> </filter></p>
<p style="font-family:arial,sans-serif;font-size:small">
<resolutionTime>run</resolutionTime></p>
<p style="font-family:arial,sans-serif;font-size:small"> </approverRef></p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">If
I reduce the number of users in Midpoint, the
approval request/response gets faster.</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">On
the other hand, If I specify a static list of
approverRef like :</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small"><approverRef
oid="00000000-0000-0000-0000-000000000000"
type="c:UserType"></p>
<p style="font-family:arial,sans-serif;font-size:small"><approverRef
oid="00000000-0000-0000-0000-000000000000"
type="c:UserType"></p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">Or
a dynamic list of approvers through an
approverExpression like :</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small"><approverExpression></p>
<p style="font-family:arial,sans-serif;font-size:small">
<script></p>
<p style="font-family:arial,sans-serif;font-size:small">
<code>midpoint.getMembersAsReferences("00000000-0000-0000-0000-000000000000")</code></p>
<p style="font-family:arial,sans-serif;font-size:small">
</script></p>
<p style="font-family:arial,sans-serif;font-size:small"></approverExpression></p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">Then ,
even with 20000+ users, the approval
request/response takes less than a second to be
processed.</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">For
reference, the full global policy rule :</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small"><globalPolicyRule></p>
<p style="font-family:arial,sans-serif;font-size:small">
<name>Delete user approvals</name></p>
<p style="font-family:arial,sans-serif;font-size:small">
<policyConstraints></p>
<p style="font-family:arial,sans-serif;font-size:small">
<modification></p>
<p style="font-family:arial,sans-serif;font-size:small">
<operation>delete</operation></p>
<p style="font-family:arial,sans-serif;font-size:small">
</modification></p>
<p style="font-family:arial,sans-serif;font-size:small">
</policyConstraints></p>
<p style="font-family:arial,sans-serif;font-size:small">
<policyActions></p>
<p style="font-family:arial,sans-serif;font-size:small">
<approval></p>
<p style="font-family:arial,sans-serif;font-size:small">
<approvalSchema></p>
<p style="font-family:arial,sans-serif;font-size:small">
<stage></p>
<p style="font-family:arial,sans-serif;font-size:small">
<approverRef
oid="00000000-0000-0000-0000-000000000000"
relation="org:default" type="c:OrgType"></p>
<p style="font-family:arial,sans-serif;font-size:small">
<!-- Administrateurs Identités Arobas --></p>
<p style="font-family:arial,sans-serif;font-size:small">
</approverRef></p>
<p style="font-family:arial,sans-serif;font-size:small">
<automaticallyCompleted></p>
<p style="font-family:arial,sans-serif;font-size:small">
<description>If the user has the superuser
role, we automatically approve</description></p>
<p style="font-family:arial,sans-serif;font-size:small">
<script></p>
<p style="font-family:arial,sans-serif;font-size:small">
<code></p>
<p style="font-family:arial,sans-serif;font-size:small">
if
(midpoint.isDirectlyAssigned(actor,
"00000000-0000-0000-0000-000000000004")) {</p>
<p style="font-family:arial,sans-serif;font-size:small">
return 'skip';</p>
<p style="font-family:arial,sans-serif;font-size:small">
}</p>
<p style="font-family:arial,sans-serif;font-size:small">
else {</p>
<p style="font-family:arial,sans-serif;font-size:small">
return null;</p>
<p style="font-family:arial,sans-serif;font-size:small">
}</p>
<p style="font-family:arial,sans-serif;font-size:small">
</code></p>
<p style="font-family:arial,sans-serif;font-size:small">
</script></p>
<p style="font-family:arial,sans-serif;font-size:small">
</automaticallyCompleted></p>
<p style="font-family:arial,sans-serif;font-size:small">
</stage></p>
<p style="font-family:arial,sans-serif;font-size:small">
</approvalSchema></p>
<p style="font-family:arial,sans-serif;font-size:small">
</approval></p>
<p style="font-family:arial,sans-serif;font-size:small">
</policyActions></p>
<p style="font-family:arial,sans-serif;font-size:small">
<focusSelector></p>
<p style="font-family:arial,sans-serif;font-size:small">
<type>UserType</type></p>
<p style="font-family:arial,sans-serif;font-size:small">
</focusSelector></p>
<p style="font-family:arial,sans-serif;font-size:small">
</globalPolicyRule></p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">An
excerpt of the trace:</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 DEBUG: ##### Exit: 2255272
...repo.cache.RepositoryCache->getObject# etime:
1.311 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 TRACE: ###### retval:
systemConfiguration:00000000-0000-0000-0000-000000000001(SystemConfiguration)</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 DEBUG: ##### Exit: 2255271
...wf.impl.engine.helpers.NotificationHelper->sendPreparedNotifications
etime: 1.755 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 DEBUG: ##### Exit: 2255257
...wf.impl.engine.EngineInvocationContext->commit
etime: 40.146 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 DEBUG: ##### Exit: 2255157
...wf.impl.engine.WorkflowEngine->executeRequest
etime: 25067.345 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 DEBUG: ##### Exit: 2255136
...wf.impl.processors.primary.PrimaryChangeProcessor->executeStartInstructions
etime: 25146.234 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 DEBUG: ##### Exit: 2255118
...wf.impl.processors.primary.PrimaryChangeProcessor->previewOrProcessModelInvocation
etime: 25153.706 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,948 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: ##### Exit: 2255117
...wf.impl.hook.WfHook->invoke etime: 25153.876
ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: ##### Exit: 2254939
...model.impl.lens.Clockwork->click etime:
25198.070 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: #### Entry: 2255276
...provisioning.impl.ProvisioningServiceImpl->exitConstraintsCheckerCache#</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 TRACE: ###### args: ()</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: ##### Exit: 2255276
...provisioning.impl.ProvisioningServiceImpl->exitConstraintsCheckerCache#
etime: 0.012 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 TRACE: ###### retval: null</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: ##### Exit: 2254935
...model.impl.lens.Clockwork->run etime:
25198.487 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: ##### Exit: 2254934
...model.api.ModelService->executeChanges etime:
25198.728 ms</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 TRACE: ###### retval: {}</p>
<p style="font-family:arial,sans-serif;font-size:small">2019-10-21
17:22:16,949 DEBUG: ##### Exit: 2254933
...model.impl.controller.ModelController->executeChanges#
etime: 25201.841 ms</p>
<p style="font-family:arial,sans-serif;font-size:small"> </p>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" rel="noreferrer noreferrer noreferrer" target="_blank">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" rel="noreferrer
noreferrer noreferrer" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer noreferrer noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote>
</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" target="_blank" rel="noreferrer">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank" rel="noreferrer">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank" rel="noreferrer">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>