Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-59600

Deleting a group may take a long time due to Space permissions calculations

      Issue Summary

      During a group deletion, Confluence retrieves all space permissions (for each space) from DB, and then filters them by that group.
      Eventually, it means that Confluence loads permissions for all spaces from DB.
      In the case of a Data Center instance, it takes even longer because all this information is loaded to the distributed cache.
      In broad terms, that explains why it may take so much time to confirm the deletion of a group: Confluence is calculating space permissions prior to the deletion. Screenshot below.
      The deletion itself is pretty fast. But depending on the number of spaces and groups an environment has, the space permissions calculations can take from several seconds to several minutes.

      Environment

      Observed in these versions:

      • Confluence 6.13.4, 6.13.6, but this is also observable in any 6.x versions.

      Steps to Reproduce

      Scenario 1 (single space/group)

      1. install a vanilla instance
      2. create a sample space, named SpaceA
      3. create a sample group, named GroupA
      4. create space permission in SpaceA related to GroupA
      5. flush Cache to ensure data will be loaded from DB
      6. now go to Confluence Administration > General Configuration > Groups
      7. delete GroupA
        • it will show a confirmation screen, loading all the spaces permissions that are related to this group
        • this time will load pretty fast because there are just one space and one group
        • in a controlled test, this scenario took 600ms to complete
      8. cancel the deletion

      Scenario 2 (multiple spaces / single group)
      This is not a real scenario but we tested it to illustrate an increase in complexity.
      However, it's still far from a customer real environment due to scalability (customers tend to have thousands of spaces/groups instead of hundreds)

      1. install a vanilla instance
      2. create 100 spaces, named Space1 {2,3,4 etc}
      3. create a sample group, named Group1
      4. create space permission in each Space(N) related to Group1
      5. flush Cache to ensure data will be loaded from DB
      6. now go to Confluence Administration > General Configuration > Groups
      7. delete Group1
        • it will show a confirmation screen, loading all the spaces permissions that are related to this group
        • this time it may take a little longer due to space permissions calculations showing the behavior
        • in a controlled test, this scenario took 2.1 secs to complete
      8. cancel the deletion

      Expected Results

      • Scenario 2
        • The group deletion confirmation screen to load without any further delay.

      Actual Results

      • Scenario 2
        • The group deletion confirmation screen took a longer time than Scenario 1 due to space permissions calculations.
          This only gets worse the more spaces/groups you add to the scenario (we tested 100 spaces related to 100 groups and it took around 4.5 seconds)
          In a real situation with a prod environment from a customer, ~6600 groups related to ~790 spaces, it takes +2 minutes to complete the space permissions calculations.

      Workaround

      Since the problem lies in the space permissions calculations, you can bypass it and go straight to the actual group deletion action, using the RPC-API SOAP call.
      Example below.
      For reference: Confluence XML RPC and SOAP APIs

      #!/bin/bash
      
      ADMIN_USRNAME=<adminuser>
      ADMIN_USRPWD=<adminpwd>
      CONFLUENCE_BASE_URL="http://<host>/confluence"
      GROUP_NAME=<group_name>
      API_METHOD=removeGroup
      
      echo "Deleting group ${GROUP_NAME} ..."
      curl \
          --user $ADMIN_USRNAME:$ADMIN_USRPWD \
          -H "Content-Type: application/json" \
          -H "Accept: application/json" \
          -X POST \
          -d '{ "jsonrpc" : "2.0", "method" : "'${API_METHOD}'", "params" : ["'${GROUP_NAME}'", ""], "id": 7 }' \
          ${CONFLUENCE_BASE_URL}/rpc/json-rpc/confluenceservice-v2?os_authType=basic 2>/dev/null | jq -r '.'
      

            [CONFSERVER-59600] Deleting a group may take a long time due to Space permissions calculations

            There are no comments yet on this issue.

              Unassigned Unassigned
              omedeiros@atlassian.com Osimar Medeiros
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated: