Re: cannot run the launchpad
Hi,
In fact, today I observed 80 failed tests after fully rebuilding sling.
Is that reported?
Cheers,
Jos
On 10/19/2010 07:06 PM, Sandro Boehme wrote:
Hello,
since quite some time I'm trying to get the launchpad running in Jetty.
I build sling on a clean checkout from SVN without errors but the
launchpad doesn't start as it is missing the Emma classes at runtime
(see output below).
Can you tell me where I have to add the dependency to emma?
Best,
Sandro
Sandros-MacBook:builder sboehme$ mvn jetty:run
Listening for transport dt_socket at address: 30303
[INFO] Scanning for projects...
[INFO]
[INFO] Building Apache Sling Launchpad Application Builder
[INFO]task-segment: [jetty:run]
[INFO]
[INFO] Preparing jetty:run
[INFO] [enforcer:enforce {execution: enforce-java}]
[INFO] [groovy:execute {execution: save-bundle-metadata}]
[INFO] [launchpad:prepare-package {execution: prepare-package-war}]
[INFO] [launchpad:prepare-package {execution: prepare-package-jar}]
[INFO] Unpacking
/Users/sboehme/maven_local_repo/org/apache/sling/org.apache.sling.launchpad.base/2.2.1-SNAPSHOT/org.apache.sling.launchpad.base-2.2.1-SNAPSHOT-app.jar
to
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/target/classes
[INFO] Setting property: classpath.resource.loader.class =>
'org.codehaus.plexus.velocity.ContextClassLoaderResourceLoader'.
[INFO] Setting property: velocimacro.messages.on => 'false'.
[INFO] Setting property: resource.loader => 'classpath'.
[INFO] Setting property: resource.manager.logwhenfound => 'false'.
[INFO] [remote-resources:process {execution: default}]
[INFO] [resources:resources {execution: default-resources}]
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] skip non existing resourceDirectory
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/src/main/resources
[INFO] Copying 3 resources
[INFO] [antrun:run {execution: default}]
[INFO] Executing tasks
[echo] WARNING (SLING-443/SLING-1782)
**
[echo] On most platforms, you'll get OutOfMemoryErrors when
building unless you set
[echo] on 32bit platforms: MAVEN_OPTS="-Xmx256M
-XX:MaxPermSize=256M", see SLING-443
[echo] on 64bit platforms: MAVEN_OPTS="-Xmx512M
-XX:MaxPermSize=512M", see SLING-1782
[echo]
**
[INFO] Executed tasks
[INFO] [compiler:compile {execution: default-compile}]
[INFO] No sources to compile
[INFO] [resources:testResources {execution: default-testResources}]
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] skip non existing resourceDirectory
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/src/test/resources
[INFO] Copying 3 resources
[INFO] [compiler:testCompile {execution: default-testCompile}]
[INFO] No sources to compile
[INFO] [jetty:run {execution: default-cli}]
[INFO] Configuring Jetty for project: Apache Sling Launchpad
Application Builder
[INFO] Webapp source directory =
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/target/org.apache.sling.launchpad-6-SNAPSHOT
[INFO] Reload Mechanic: automatic
[INFO] Classes =
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/target/classes
2010-10-19 18:33:02.452::INFO: Logging to STDERR via
org.mortbay.log.StdErrLog
[INFO] Context path = /
[INFO] Tmp directory = determined at runtime
[INFO] Web defaults = org/mortbay/jetty/webapp/webdefault.xml
[INFO] Web overrides = none
[INFO] Adding overlay:
jar:file:/Users/sboehme/maven_local_repo/org/apache/sling/org.apache.sling.launchpad.base/2.2.1-SNAPSHOT/org.apache.sling.launchpad.base-2.2.1-SNAPSHOT-webapp.war!/
[INFO] web.xml file =
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/target/org.apache.sling.launchpad-6-SNAPSHOT/WEB-INF/web.xml
[INFO] Webapp directory =
/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/target/org.apache.sling.launchpad-6-SNAPSHOT
[INFO] Starting jetty 6.1.20 ...
2010-10-19 18:33:02.476::INFO: jetty-6.1.20
2010-10-19 18:33:02.673::INFO: No Transaction manager found - if your
webapp requires one, please configure one.
2010-10-19 18:33:03.162::WARN: failed sling:
java.lang.NoClassDefFoundError: com/vladium/emma/rt/RT
2010-10-19 18:33:03.162::WARN: failed
org.mortbay.jetty.plugin.jetty6pluginwebappcont...@9946e0{/,file:/Users/sboehme/Documents/workspaces/slingtrunk/launchpad/builder/target/org.apache.sling.launchpad-6-SNAPSHOT/;jar:file:/Users/sboehme/maven_local_repo/org/apache/sling/org.apache.sling.launchpad.base/2.2.1-SNAPSHOT/org.apache.sling.launchpad.base-2.2.1-SNAPSHOT-webapp.war!/;}:
java.lang.NoClassDefFoundError: com/vladium/emma/rt/RT
2010-10-19 18:33:03.162::WARN: failed contexthandlercollect...@8be01:
java.lang.NoClassDefF
exhaustive list
Please find the exhaustive list below: testEscapedErrorMessages(org.apache.sling.launchpad.webapp.integrationtest.issues.SLING760Test) testRequestAttribute(org.apache.sling.launchpad.webapp.integrationtest.RequestAttributeTest) testWithExactUrl(org.apache.sling.launchpad.webapp.integrationtest.GetWithSuffixTest) testGETScript(org.apache.sling.launchpad.webapp.integrationtest.GetWithSuffixTest) testWithExtraPathA(org.apache.sling.launchpad.webapp.integrationtest.GetWithSuffixTest) testCallFooHtml(org.apache.sling.launchpad.webapp.integrationtest.issues.SLING457Test) testCallHtml(org.apache.sling.launchpad.webapp.integrationtest.issues.SLING457Test) testGenericProvider(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testGroovyProvider(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testJSPProvider(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testJSPProviderEL(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testCanAddUser(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanAddGroup(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanUpdateUserProperties(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanUpdateGroupProperties(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanRemoveUser(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanRemoveGroup(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanUpdateGroupMembers(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithoutInclude(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithInclude(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithIncludeAndExtension(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithoutForward(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testWithForward(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testWithForwardAndExtension(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testRecursiveDump(org.apache.sling.launchpad.webapp.integrationtest.JavascriptWrappersTest) testWithoutForward(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testWithForward(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testWithForwardAndExtension(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testSuperTypeOnResource(org.apache.sling.launchpad.webapp.integrationtest.ResourceSuperTypeTest) testSuperTypeOnScriptFolder(org.apache.sling.launchpad.webapp.integrationtest.ResourceSuperTypeTest) testEspScript(org.apache.sling.launchpad.webapp.integrationtest.ExecuteScriptTest) testJspScript(org.apache.sling.launchpad.webapp.integrationtest.ExecuteScriptTest) testNestedInclude(org.apache.sling.launchpad.webapp.integrationtest.EspLoadTest) testNonExistentInclude(org.apache.sling.launchpad.webapp.integrationtest.EspLoadTest) testJSONGroovyBuilder(org.apache.sling.launchpad.webapp.integrationtest.JSONGroovyBuilderIntegrationTest) testJSONGroovyBuilder2(org.apache.sling.launchpad.webapp.integrationtest.JSONGroovyBuilderIntegrationTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testWithoutInclude(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testWithInclude(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testWithIncludeAndExtension(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testMaxCallsDetection(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testEspHtml(org.apache.sling.launchpad.webapp.integrationtest.SlingResourceTypeRenderingTest) testGspHtml(org.apache.sling.launchpad.webapp.integrationtest.SlingResourceTypeRenderingTest) testEspJavaCode(org.apache.sling.launchpad.webapp.integrationtest.SlingResourceTypeRenderingTest) testGspJavaCode(org.apache.sling.launchpad.webapp.integrationtest.SlingResourceTypeRenderingTest) testE
Re: exhaustive list
Confirmed, Felix! Sling builds gracefully now! Cheers, Jos On 10/25/2010 09:15 AM, Felix Meschberger wrote: Hi, I would assume this is by now fixed. Right ? Regards Felix On 20.10.2010 15:08, Jos Snellings wrote: Please find the exhaustive list below: testEscapedErrorMessages(org.apache.sling.launchpad.webapp.integrationtest.issues.SLING760Test) testRequestAttribute(org.apache.sling.launchpad.webapp.integrationtest.RequestAttributeTest) testWithExactUrl(org.apache.sling.launchpad.webapp.integrationtest.GetWithSuffixTest) testGETScript(org.apache.sling.launchpad.webapp.integrationtest.GetWithSuffixTest) testWithExtraPathA(org.apache.sling.launchpad.webapp.integrationtest.GetWithSuffixTest) testCallFooHtml(org.apache.sling.launchpad.webapp.integrationtest.issues.SLING457Test) testCallHtml(org.apache.sling.launchpad.webapp.integrationtest.issues.SLING457Test) testGenericProvider(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testGroovyProvider(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testJSPProvider(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testJSPProviderEL(org.apache.sling.launchpad.webapp.integrationtest.ScriptBindingsValuesProviderTest) testCanAddUser(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanAddGroup(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanUpdateUserProperties(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanUpdateGroupProperties(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanRemoveUser(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanRemoveGroup(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testCanUpdateGroupMembers(org.apache.sling.launchpad.webapp.integrationtest.userManager.PrivilegesInfoTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithoutInclude(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithInclude(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithIncludeAndExtension(org.apache.sling.launchpad.webapp.integrationtest.IncludeTest) testWithoutForward(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testWithForward(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testWithForwardAndExtension(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.ForwardTest) testRecursiveDump(org.apache.sling.launchpad.webapp.integrationtest.JavascriptWrappersTest) testWithoutForward(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testWithForward(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testWithForwardAndExtension(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.JspForwardTest) testSuperTypeOnResource(org.apache.sling.launchpad.webapp.integrationtest.ResourceSuperTypeTest) testSuperTypeOnScriptFolder(org.apache.sling.launchpad.webapp.integrationtest.ResourceSuperTypeTest) testEspScript(org.apache.sling.launchpad.webapp.integrationtest.ExecuteScriptTest) testJspScript(org.apache.sling.launchpad.webapp.integrationtest.ExecuteScriptTest) testNestedInclude(org.apache.sling.launchpad.webapp.integrationtest.EspLoadTest) testNonExistentInclude(org.apache.sling.launchpad.webapp.integrationtest.EspLoadTest) testJSONGroovyBuilder(org.apache.sling.launchpad.webapp.integrationtest.JSONGroovyBuilderIntegrationTest) testJSONGroovyBuilder2(org.apache.sling.launchpad.webapp.integrationtest.JSONGroovyBuilderIntegrationTest) testInfiniteLoopDetection(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testForcedResourceType(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testWithoutInclude(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testWithInclude(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testWithIncludeAndExtension(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testMaxCallsDetection(org.apache.sling.launchpad.webapp.integrationtest.JspIncludeTest) testEspHtml(org.apache.sling.launchpad.webapp.integrationtest.SlingResourceTypeRenderingTest) testGspHtml(org.apache.sling.launchpad.webapp.integrationtest.SlingResourceTypeRenderingTest) testEspJavaCode
Re: Scripted ACLs/Authorization
About performance: You mean that the result is generated first, and this is filtered against the ACL. I remember from my own experience that this was a horror in Alfresco a couple of years ago, when a system had to query a large archive of insurance policies. Are there plans to optimize this? Jos On 11/08/2010 03:18 PM, Ian Boston wrote: Oops, I see you referenced our docs on the subject, The scripts need to be executed on ACL evaluation since the user and time are input parameters. Since they are inside the AccessManager, the system session would be the one executing the scripts. Performance is an issue, but we normally deal with that with caching of the result against user. Ian On 8 Nov 2010, at 14:03, Ian Boston wrote: We have been using exrta properties on ACE's to allow the AccessControlManager to determine if the ACE is enabled for the current user and the current time. Ian On 8 Nov 2010, at 14:01, Clemens Wyss wrote: Often the basic ACL features are not sufficient to represent all authorization needs (http://dev.day.com/content/ddc/blog/2009/01/theaclisdead.html ). Wouldn't it be nice if we could define our authorization needs in an "Authorization DSL" ( in Groovy or jRuby ;-) ) which then could be applied to a node, or even better a node type? What about a mixin type: [sling:ScriptedACL] mixin + sling:aclScript protected mandatory The aclScript would be written in the Authorization DSL. Predefined variables would provide access to the current node, session, etc "Dynamic ACL" (http://confluence.sakaiproject.org/display/KERNDOC/KERN-629+Time+base+ACL) would become a subset of this feature as this could be solved alike. I agree, there are still many open points such as: - who should execute these scripts? - when should these scripts be executed? - performance implications? WDYT?
ACL evaluation with scattered permissions
You are right, Ian, This question deserves a new thread. Currently I am drawing up an architecture for a file handling system for e-government: permissions are scattered up to: - the citizen : one active file for a citizen (= folder, infoholder in xml, attachments) - the community : visibility and handling for the citizens of one community - the regional authority : regional indicators This worries me for it is a typical case where you would run into scalability problems. Think of 50 000 open applications via that system. With 10 documents per application you would have 500 000. Is that a nogo for Sling? Would be a pity. I wanted to come up with an elegant solution :-) Jos On 11/09/2010 09:22 AM, Ian Boston wrote: Jos, If by result you mean a search result, then thats a separate issue from the dynamic ACL itself, and not the direct subject of this thread. When I said performance I was referring to the atomic act of determining if the ACE was active for any attempt to access an item, not just search results. However, thats the way jackrabbit works. JCR searches are "compiled" into Lucene Queries that generate Lucene Hits where the Lucene document contains a node ID, which is extracted in the normal manner from JCR (IIRC). If the current user cant read the item, its discarded. This is fine for dense searches where most items can be read by the user, but problematic for sparse searches. Its also problematic for sorts that can't be performed inside Lucene, as this results in all the items being loaded into memory before searching. One way to avoid sorts of this form is to ban "order by" clauses that reference any items other than properties of the node found. BTW, problematic == non scalable, vertically or horizontally. Ian
Re: ACL evaluation with scattered permissions
Thank you for your prompt answer, Ian. You mean "the natural way". That would be true for a citizen. That would be true for a community, so a path could be Stockholm/234987488. But to extract a regional indicator, like 'how many applications were handled on time during the first half of 2014'. This is something that is not requested in the first place, but I know it *will* come up. ==> then the user performing this query would have read access on all files. Would the query scale better? Thanks, Jos On 11/09/2010 07:56 PM, Ian Boston wrote: On 9 Nov 2010, at 13:11, Jos Snellings wrote: You are right, Ian, This question deserves a new thread. Currently I am drawing up an architecture for a file handling system for e-government: permissions are scattered up to: - the citizen : one active file for a citizen (= folder, infoholder in xml, attachments) - the community : visibility and handling for the citizens of one community - the regional authority : regional indicators This worries me for it is a typical case where you would run into scalability problems. Think of 50 000 open applications via that system. With 10 documents per application you would have 500 000. If 1 user only has access to 10 applications, then doing a search that finds 500,000 applications only to return 10 readable ones would not scale, just as a table scan on a RDBMS table containing .5M rows with no index would also not scale. Is that a nogo for Sling? Would be a pity. I wanted to come up with an elegant solution :-) Sling is not the issue here, its Jackrabbit, and knowing that the above situation does not scale you would do 2 things. Never use that type of search. Access all data via pointers and paths into the data based on something that was not a search. eg if the application was 2919100291 you might find the application and all the information in /applications/29/19/10/2919100291 and if the user had an ID of e31231231432 they might have a folder /users/e3/12/31/23/1432 with a sub folder 2919100291 containing a property egov:application-path : /applications/29/19/10/2919100291 ie you have to model your data to avoid searches and non direct access pathways, but.. Please ask on us...@jackrabbit.a.o as the committers there will be able to give you a complete and honest answer to if Jackrabbit is a No Go. and do some tests to prove to yourself that it will work at the scale that you want. (bash + curl + sling is a good way of doing these sort of tests) Jos On 11/09/2010 09:22 AM, Ian Boston wrote: Jos, If by result you mean a search result, then thats a separate issue from the dynamic ACL itself, and not the direct subject of this thread. When I said performance I was referring to the atomic act of determining if the ACE was active for any attempt to access an item, not just search results. However, thats the way jackrabbit works. JCR searches are "compiled" into Lucene Queries that generate Lucene Hits where the Lucene document contains a node ID, which is extracted in the normal manner from JCR (IIRC). If the current user cant read the item, its discarded. This is fine for dense searches where most items can be read by the user, but problematic for sparse searches. Its also problematic for sorts that can't be performed inside Lucene, as this results in all the items being loaded into memory before searching. One way to avoid sorts of this form is to ban "order by" clauses that reference any items other than properties of the node found. BTW, problematic == non scalable, vertically or horizontally. Ian
Re: ACL evaluation with scattered permissions
Thank you, Ian ! I am writing the proposal as a warned subject. Jos On 11/10/2010 10:05 AM, Ian Boston wrote: On 10 Nov 2010, at 00:09, Jos Snellings wrote: Thank you for your prompt answer, Ian. You mean "the natural way". That would be true for a citizen. That would be true for a community, so a path could be Stockholm/234987488. But to extract a regional indicator, like 'how many applications were handled on time during the first half of 2014'. This is something that is not requested in the first place, but I know it *will* come up. ==> then the user performing this query would have read access on all files. Would the query scale better? 'how many applications were handled on time during the first half of 2014' implies a date range. IIRC date ranges are problematic in Lucene and although the query might be Ok from a sparse search point of view, the date range might cause a problem. Again experimentation before committing to implementation is going to remove more of the risk. Ian Thanks, Jos On 11/09/2010 07:56 PM, Ian Boston wrote: On 9 Nov 2010, at 13:11, Jos Snellings wrote: You are right, Ian, This question deserves a new thread. Currently I am drawing up an architecture for a file handling system for e-government: permissions are scattered up to: - the citizen : one active file for a citizen (= folder, infoholder in xml, attachments) - the community : visibility and handling for the citizens of one community - the regional authority : regional indicators This worries me for it is a typical case where you would run into scalability problems. Think of 50 000 open applications via that system. With 10 documents per application you would have 500 000. If 1 user only has access to 10 applications, then doing a search that finds 500,000 applications only to return 10 readable ones would not scale, just as a table scan on a RDBMS table containing .5M rows with no index would also not scale. Is that a nogo for Sling? Would be a pity. I wanted to come up with an elegant solution :-) Sling is not the issue here, its Jackrabbit, and knowing that the above situation does not scale you would do 2 things. Never use that type of search. Access all data via pointers and paths into the data based on something that was not a search. eg if the application was 2919100291 you might find the application and all the information in /applications/29/19/10/2919100291 and if the user had an ID of e31231231432 they might have a folder /users/e3/12/31/23/1432 with a sub folder 2919100291 containing a property egov:application-path : /applications/29/19/10/2919100291 ie you have to model your data to avoid searches and non direct access pathways, but.. Please ask on us...@jackrabbit.a.o as the committers there will be able to give you a complete and honest answer to if Jackrabbit is a No Go. and do some tests to prove to yourself that it will work at the scale that you want. (bash + curl + sling is a good way of doing these sort of tests) Jos On 11/09/2010 09:22 AM, Ian Boston wrote: Jos, If by result you mean a search result, then thats a separate issue from the dynamic ACL itself, and not the direct subject of this thread. When I said performance I was referring to the atomic act of determining if the ACE was active for any attempt to access an item, not just search results. However, thats the way jackrabbit works. JCR searches are "compiled" into Lucene Queries that generate Lucene Hits where the Lucene document contains a node ID, which is extracted in the normal manner from JCR (IIRC). If the current user cant read the item, its discarded. This is fine for dense searches where most items can be read by the user, but problematic for sparse searches. Its also problematic for sorts that can't be performed inside Lucene, as this results in all the items being loaded into memory before searching. One way to avoid sorts of this form is to ban "order by" clauses that reference any items other than properties of the node found. BTW, problematic == non scalable, vertically or horizontally. Ian
