Skip to content

[2.19] Quick fix for tenant privilege performance issues #5368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cwperks merged 1 commit into from
May 27, 2025
Merged

[2.19] Quick fix for tenant privilege performance issues #5368

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1029,9 +1029,11 @@ private static boolean impliesTypePerm(
private class TenantHolder {

private SetMultimap<String, Tuple<String, Boolean>> tenantsMM = null;
private final ImmutableSet<String> allDefinedTenantNames;

public TenantHolder(SecurityDynamicConfiguration<RoleV7> roles, SecurityDynamicConfiguration<TenantV7> definedTenants) {
final Set<Future<Tuple<String, Set<Tuple<String, Boolean>>>>> futures = new HashSet<>(roles.getCEntries().size());
this.allDefinedTenantNames = ImmutableSet.copyOf(definedTenants.getCEntries().keySet());

final ExecutorService execs = Executors.newFixedThreadPool(10);

Expand All @@ -1053,7 +1055,7 @@ public Tuple<String, Set<Tuple<String, Boolean>>> call() throws Exception {

// find Wildcarded tenant patterns
List<String> matchingTenants = WildcardMatcher.from(tenant.getTenant_patterns())
.getMatchAny(definedTenants.getCEntries().keySet(), Collectors.toList());
.getMatchAny(allDefinedTenantNames, Collectors.toList());
for (String matchingTenant : matchingTenants) {
tuples.add(
new Tuple<String, Boolean>(
Expand Down Expand Up @@ -1146,7 +1148,7 @@ public Map<String, Boolean> mapTenants(final User user, Set<String> roles) {
// Indeed, because we don't have control over what will be
// passed on as values of users' attributes, we have to make
// sure that we don't allow them to select tenants that do not exist.
if (ConfigModelV7.this.tenants.getCEntries().keySet().contains(tenant)) {
if (this.allDefinedTenantNames.contains(tenant)) {
result.put(tenant, rw);
}
}
Expand Down
Loading