ACL performance

[bledii_]

Hi all

Suppose we have a folder with a large number of documents, that is continuously updated with other documents.

We set permission on the folder so everyone can see the folder, but set permission on every document so that only specific users can see the document inside the folder.

I have 2 questions about the above scenario:

1. How much will this impact the performance of Nuxeo
2. Is there a limit on the number of documents with specific ACL on each folder? (for example sharepoint has a limit of 50 000 for this use case. See here security scope)

[sdenef_]

Hi,

Maybe you can read this : http://doc.nuxeo.com/x/uAAt

and this : http://doc.nuxeo.com/x/xgwz (part "Capacity and Sizing")

IMHO :

• set permissions on folders (default) or documents (see http://doc.nuxeo.com/x/xgQz) : it doesn't change the perf
• there is no limit for number of childs on a document (cf "you can have folders with several thousands of child documents" on the first link of my answer) -> but it could be not user-friendly if your users see 6382 pages of docs in a folder
• if you set a very large number of ACL on the same document (folder or file) then adapt the size for the pre-computed ACLs (search about "aclOptimizations" and "readAclMaxSize" ... it can be configured in your nuxeo.conf file) -> again, think it's not user-friendly to manage a rights page with 394 ACL entries (furthermore, there is no pagination on rigths management page)

[bruce_Grant]

I have a client with > 5000 docs per folder - they wanted a very flat structure for files. It works for them because I created a custom search capability that allows them to easily narrow to documents of interest (by doc type and custom metadata fields). Without an easy way for information consumer to find content having thousands of documents in a single container might not be the best strategy.

[bledii_]

thank you both very much for the answers

[sdenef_]

Be confident.

[Florent_Guillau]

Having a large number of documents in a folder is not a problem, although as pointed out you have to adapt the UI as page-based navigation isn't user-friendly in that case.

Having different ACLs on each of those documents is not a problem either, although of course some ACL-based tables will grow bigger as a result.

As asked in a comment above, when you list a folder at any time a filter is done using the aforementioned tables but again that's normal behavior.

[Florent_Guillau]

And of course the best way to make sure in your actual situation is to run your own benchmark.