Topic
  • 7 replies
  • Latest Post - ‏2010-01-05T12:32:32Z by JavaAdam
JavaAdam
JavaAdam
6 Posts

Pinned topic ACL out of date - CM8

‏2009-12-15T09:25:51Z |
Hello,

I've got an issue with out dated ACLs on folders. When my client is logged in only changes via this client instance are shown properly. Changes at ACLs by another clients are not propagated. They are shown properly after a relogin. This leads to inconsistent ACL Views.

Do I have to force an update manually? How can I do this?
Or is this a bug in CIEE?

Greetings
Adam
Updated on 2010-01-05T12:32:32Z at 2010-01-05T12:32:32Z by JavaAdam
  • SystemAdmin
    SystemAdmin
    254 Posts

    Re: ACL out of date - CM8

    ‏2009-12-15T18:18:07Z  
    Hello Adam,

    to help us investigate this problem, could you please post the versions of CM8, II4C and IICE? Are ACLs configured on an item type level or item level in the repository?

    Thanks
    Daniela
  • SystemAdmin
    SystemAdmin
    254 Posts

    Re: ACL out of date - CM8

    ‏2009-12-16T06:00:57Z  
    Hello Adam,

    to help us investigate this problem, could you please post the versions of CM8, II4C and IICE? Are ACLs configured on an item type level or item level in the repository?

    Thanks
    Daniela
    Hi Adam

    actually, the AccessControlList object is cached on the ContentBase object in the IICE Client API. For most users, this behavior is beneficial as retrieving an ACL is a costly operation on CM8 and ACLs don't change often. However, if in your case the caching leads to undesired consequences, you could
    • re-retrieve the repo item, or
    • null out the cache by calling ContentBase.setAccessControlList(null) (assuming you have IICE 8.5 or later)

    Daniela
  • JavaAdam
    JavaAdam
    6 Posts

    Re: ACL out of date - CM8

    ‏2009-12-16T12:42:05Z  
    Hi Adam

    actually, the AccessControlList object is cached on the ContentBase object in the IICE Client API. For most users, this behavior is beneficial as retrieving an ACL is a costly operation on CM8 and ACLs don't change often. However, if in your case the caching leads to undesired consequences, you could
    • re-retrieve the repo item, or
    • null out the cache by calling ContentBase.setAccessControlList(null) (assuming you have IICE 8.5 or later)

    Daniela
    Hello Daniela,

    thank you very much for the fast response. But I could not resolve the ACL problem by following your suggestions. But at first here are some datas about my environment:

    CIEE 8.5.1
    CM8DB2 8.4.1
    II4C 8.4.1

    I tried to flush the ACL cache by invoking Folder.setAccessControlList(null). The other option was to re-retrieve the Folder by Repository.getFolder(folderId). Both ways did not help.

    Or do I have to re-retrieve the Folder at another way?

    Thanks
    Adam
  • SystemAdmin
    SystemAdmin
    254 Posts

    Re: ACL out of date - CM8

    ‏2009-12-19T06:38:49Z  
    • JavaAdam
    • ‏2009-12-16T12:42:05Z
    Hello Daniela,

    thank you very much for the fast response. But I could not resolve the ACL problem by following your suggestions. But at first here are some datas about my environment:

    CIEE 8.5.1
    CM8DB2 8.4.1
    II4C 8.4.1

    I tried to flush the ACL cache by invoking Folder.setAccessControlList(null). The other option was to re-retrieve the Folder by Repository.getFolder(folderId). Both ways did not help.

    Or do I have to re-retrieve the Folder at another way?

    Thanks
    Adam
    Hi Adam

    I can reproduce the behavior you're seeing. Updates to ACLs from client A are not visible to client B unless client B reconnects, even if client B clears the ICI cache in ContentBase. As it turns out, II4C also caches the ACL. "DKDatastoreICM", the main II4C object through which the ICI CM8 Connector accesses the repository, maintains a local cache for things such as item types, views, users, and ACLs. There is a method in DKDatastoreICM that allows a client to clear the local cache, but the ICI CM8 Connector does not call it, as for most customers it's beneficial to cache this kind of metadata.
    To work around the issue, you could implement a subscription service that allows clients to find out if another client has modified ACLs. If so, subscribed clients could decide to reconnect. If that's not an option, you could open a PMR with IBM support and request a custom CM8 connector which clears the DKDatastoreICM cache before each ACL retrieval.

    Daniela
  • SystemAdmin
    SystemAdmin
    254 Posts

    Re: ACL out of date - CM8

    ‏2009-12-21T13:47:45Z  
    Hi Adam

    I can reproduce the behavior you're seeing. Updates to ACLs from client A are not visible to client B unless client B reconnects, even if client B clears the ICI cache in ContentBase. As it turns out, II4C also caches the ACL. "DKDatastoreICM", the main II4C object through which the ICI CM8 Connector accesses the repository, maintains a local cache for things such as item types, views, users, and ACLs. There is a method in DKDatastoreICM that allows a client to clear the local cache, but the ICI CM8 Connector does not call it, as for most customers it's beneficial to cache this kind of metadata.
    To work around the issue, you could implement a subscription service that allows clients to find out if another client has modified ACLs. If so, subscribed clients could decide to reconnect. If that's not an option, you could open a PMR with IBM support and request a custom CM8 connector which clears the DKDatastoreICM cache before each ACL retrieval.

    Daniela
    Daniela,

    IBM Support teams do not write custom code - I think you meant to say that an IBM Services team could do this.

    Jeremy
  • JavaAdam
    JavaAdam
    6 Posts

    Re: ACL out of date - CM8

    ‏2009-12-22T08:46:01Z  
    Hi Adam

    I can reproduce the behavior you're seeing. Updates to ACLs from client A are not visible to client B unless client B reconnects, even if client B clears the ICI cache in ContentBase. As it turns out, II4C also caches the ACL. "DKDatastoreICM", the main II4C object through which the ICI CM8 Connector accesses the repository, maintains a local cache for things such as item types, views, users, and ACLs. There is a method in DKDatastoreICM that allows a client to clear the local cache, but the ICI CM8 Connector does not call it, as for most customers it's beneficial to cache this kind of metadata.
    To work around the issue, you could implement a subscription service that allows clients to find out if another client has modified ACLs. If so, subscribed clients could decide to reconnect. If that's not an option, you could open a PMR with IBM support and request a custom CM8 connector which clears the DKDatastoreICM cache before each ACL retrieval.

    Daniela
    Hi Daniela,

    thank you very much for the investigation and the proposals to solve the problem. It's a pity that it does not work out of the box via CIEE with the CM8 Connector. But it helps to develope a solution.

    Greetings
    Adam
  • JavaAdam
    JavaAdam
    6 Posts

    Re: ACL out of date - CM8

    ‏2010-01-05T12:32:32Z  
    • JavaAdam
    • ‏2009-12-22T08:46:01Z
    Hi Daniela,

    thank you very much for the investigation and the proposals to solve the problem. It's a pity that it does not work out of the box via CIEE with the CM8 Connector. But it helps to develope a solution.

    Greetings
    Adam
    Hello again,

    i have tried to call DKDatastoreICM.clearCache(DKDatastoreICM.DK_CM_CLEAR_CACHE_ALL) via a Plug-In before recieving the ACL. Further I have called Content.setAccessControlList(null) before the refresh for flushing the CIEE cache. But it didn't help. The ACL is still out dated. Can someone confirm or deny this behavior?

    p.s. I know that if clearCache does not work I should ask about this in the II4C forum.... But perhaps someone has an idea here?

    Thanks
    Adam