topic Re: ACL performance in Nuxeo Forum

ACL performance

bledii_ — Fri, 11 Oct 2013 12:47:53 GMT

Hi all

Suppose we have a folder with a large number of documents, that is continuously updated with other documents.

We set permission on the folder so everyone can see the folder, but set permission on every document so that only specific users can see the document inside the folder.

I have 2 questions about the above scenario:

How much will this impact the performance of Nuxeo
Is there a limit on the number of documents with specific ACL on each folder? (for example sharepoint has a limit of 50 000 for this use case. See here security scope)

Re: ACL performance

sdenef_ — Sat, 12 Oct 2013 00:12:22 GMT

Hi,

Maybe you can read this : http://doc.nuxeo.com/x/uAAt

and this : http://doc.nuxeo.com/x/xgwz (part "Capacity and Sizing")

IMHO :

set permissions on folders (default) or documents (see http://doc.nuxeo.com/x/xgQz) : it doesn't change the perf
there is no limit for number of childs on a document (cf "you can have folders with several thousands of child documents" on the first link of my answer) -> but it could be not user-friendly if your users see 6382 pages of docs in a folder
if you set a very large number of ACL on the same document (folder or file) then adapt the size for the pre-computed ACLs (search about "aclOptimizations" and "readAclMaxSize" ... it can be configured in your nuxeo.conf file) -> again, think it's not user-friendly to manage a rights page with 394 ACL entries (furthermore, there is no pagination on rigths management page)

Re: ACL performance

bruce_Grant — Sun, 13 Oct 2013 21:41:21 GMT

I have a client with > 5000 docs per folder - they wanted a very flat structure for files. It works for them because I created a custom search capability that allows them to easily narrow to documents of interest (by doc type and custom metadata fields). Without an easy way for information consumer to find content having thousands of documents in a single container might not be the best strategy.

Re: ACL performance

bledii_ — Mon, 14 Oct 2013 09:53:48 GMT

thank you both very much for the answers

Re: ACL performance

Florent_Guillau — Mon, 14 Oct 2013 11:59:24 GMT

Having a large number of documents in a folder is not a problem, although as pointed out you have to adapt the UI as page-based navigation isn't user-friendly in that case.

Having different ACLs on each of those documents is not a problem either, although of course some ACL-based tables will grow bigger as a result.

As asked in a comment above, when you list a folder at any time a filter is done using the aforementioned tables but again that's normal behavior.

Re: ACL performance

Florent_Guillau — Mon, 14 Oct 2013 11:59:53 GMT

And of course the best way to make sure in your actual situation is to run your own benchmark.

Re: ACL performance

sdenef_ — Mon, 14 Oct 2013 12:36:30 GMT

Be confident.