Usage of implicitResources in ClusterManagerBean#buildQuery

John Mazzitelli mazz at redhat.com
Tue Oct 9 15:11:44 UTC 2012


Implicit members are used for recursive groups. IIRC, if you have a non-recursive group (doesn't matter if its a mixed group or compatible group), the implicit group membership will be the same as the explicit group membership.

If you have a recursive group, it means the members of the group will not only be the resources you explicitly put into the group (hence the name "explicit members") but it also means all of the children of those resources will also be automatically (implicitly) added as members of that group (hence the name "implicit members").

Recursive groups are normally only used for authorizing access to its members (hence the comment you see). For example, if you want users in the role "app server admins" to have access to your app server resources, you can just create a group of app server resources, make it recursive, and give access to that group to your "app server admins" role. Now the users in that role can access any resource associated with the app servers (including their children resources like datasources, web apps, etc).

To perform authorization checks, RHQ checks the implicit resources because if you are a user trying to look at a webapp resource, for example, RHQ needs to not only look at the explicit members of that group but must also see if a group you have access to has that resource in its implicit members as well. So it just checks implicit membership (note: explicit resources are also in the implicit resource list - in other words, the explicit resource list is a subset of the implicit resource list - for non-recursive groups, explicit resource set is the same as the implicit resource set).

----- Original Message -----
> ClusterManagerBean#buildQuery contains the following code:
> 
>         // this is an authorization-related query, so use
> implicitResource (not explicitResources)
>         if (1 == size) {
>             query
>                 .append("SELECT rgir FROM ResourceGroup rg JOIN
> rg.implicitResources rgir WHERE rgir.inventoryStatus = 'COMMITTED'
> AND
> rg = "
>                 + clusterKey.getClusterGroupId());
>         } else {
>             buildQuery(query, params, clusterKey, nodes.subList(0,
>             size - 1));
>         }
> 
> We have a situation where the usage of implicitResources instead of
> explicitResources appears to cause a performance issue. This occurs
> for depth 3 resources related to the JVM (e.g. as JVM > Memory
> Subsystem > MarkSweepCompact) in a compatible group. When trying to
> open the summary for such a resource, the request times out because
> the database takes too much time to complete the query. Note that
> other resources at depth 3 are not affected by this problem. My guess
> is that this is related to the fact that the keys of the resources in
> the hierarchy ('JVM', 'java.lang:type=Memory' and
> 'java.lang:name=MarkSweepCompact,type=GarbageCollector' in the
> example) for these resources are "less unique" than for other
> resources (we have 39 JVMs in the inventory).
> 
> I tested the problematic database query, and if I replace
> RHQ_RESOURCE_GROUP_RES_IMP_MAP by RHQ_RESOURCE_GROUP_RES_EXP_MAP,
> then
> it returns the same results, but much faster. Therefore I would like
> to understand the meaning of the comment "this is an
> authorization-related query, so use implicitResource (not
> explicitResources)". Can somebody explain that to me?
> 
> Andreas
> 
> PS: I've investigated this with RHQ 4.5.1, but 3.0.0 had the same
> problem.
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 


More information about the rhq-devel mailing list