Topic
7 replies Latest Post - ‏2010-01-05T12:32:32Z by JavaAdam
JavaAdam
JavaAdam
6 Posts
ACCEPTED ANSWER

Pinned topic ACL out of date - CM8

‏2009-12-15T09:25:51Z |
Hello,

I've got an issue with out dated ACLs on folders. When my client is logged in only changes via this client instance are shown properly. Changes at ACLs by another clients are not propagated. They are shown properly after a relogin. This leads to inconsistent ACL Views.

Do I have to force an update manually? How can I do this?
Or is this a bug in CIEE?

Greetings
Adam
Updated on 2010-01-05T12:32:32Z at 2010-01-05T12:32:32Z by JavaAdam
  • SystemAdmin
    SystemAdmin
    254 Posts
    ACCEPTED ANSWER

    Re: ACL out of date - CM8

    ‏2009-12-15T18:18:07Z  in response to JavaAdam
    Hello Adam,

    to help us investigate this problem, could you please post the versions of CM8, II4C and IICE? Are ACLs configured on an item type level or item level in the repository?

    Thanks
    Daniela
    • SystemAdmin
      SystemAdmin
      254 Posts
      ACCEPTED ANSWER

      Re: ACL out of date - CM8

      ‏2009-12-16T06:00:57Z  in response to SystemAdmin
      Hi Adam

      actually, the AccessControlList object is cached on the ContentBase object in the IICE Client API. For most users, this behavior is beneficial as retrieving an ACL is a costly operation on CM8 and ACLs don't change often. However, if in your case the caching leads to undesired consequences, you could
      • re-retrieve the repo item, or
      • null out the cache by calling ContentBase.setAccessControlList(null) (assuming you have IICE 8.5 or later)

      Daniela
      • JavaAdam
        JavaAdam
        6 Posts
        ACCEPTED ANSWER

        Re: ACL out of date - CM8

        ‏2009-12-16T12:42:05Z  in response to SystemAdmin
        Hello Daniela,

        thank you very much for the fast response. But I could not resolve the ACL problem by following your suggestions. But at first here are some datas about my environment:

        CIEE 8.5.1
        CM8DB2 8.4.1
        II4C 8.4.1

        I tried to flush the ACL cache by invoking Folder.setAccessControlList(null). The other option was to re-retrieve the Folder by Repository.getFolder(folderId). Both ways did not help.

        Or do I have to re-retrieve the Folder at another way?

        Thanks
        Adam
        • SystemAdmin
          SystemAdmin
          254 Posts
          ACCEPTED ANSWER

          Re: ACL out of date - CM8

          ‏2009-12-19T06:38:49Z  in response to JavaAdam
          Hi Adam

          I can reproduce the behavior you're seeing. Updates to ACLs from client A are not visible to client B unless client B reconnects, even if client B clears the ICI cache in ContentBase. As it turns out, II4C also caches the ACL. "DKDatastoreICM", the main II4C object through which the ICI CM8 Connector accesses the repository, maintains a local cache for things such as item types, views, users, and ACLs. There is a method in DKDatastoreICM that allows a client to clear the local cache, but the ICI CM8 Connector does not call it, as for most customers it's beneficial to cache this kind of metadata.
          To work around the issue, you could implement a subscription service that allows clients to find out if another client has modified ACLs. If so, subscribed clients could decide to reconnect. If that's not an option, you could open a PMR with IBM support and request a custom CM8 connector which clears the DKDatastoreICM cache before each ACL retrieval.

          Daniela
          • SystemAdmin
            SystemAdmin
            254 Posts
            ACCEPTED ANSWER

            Re: ACL out of date - CM8

            ‏2009-12-21T13:47:45Z  in response to SystemAdmin
            Daniela,

            IBM Support teams do not write custom code - I think you meant to say that an IBM Services team could do this.

            Jeremy
          • JavaAdam
            JavaAdam
            6 Posts
            ACCEPTED ANSWER

            Re: ACL out of date - CM8

            ‏2009-12-22T08:46:01Z  in response to SystemAdmin
            Hi Daniela,

            thank you very much for the investigation and the proposals to solve the problem. It's a pity that it does not work out of the box via CIEE with the CM8 Connector. But it helps to develope a solution.

            Greetings
            Adam
            • JavaAdam
              JavaAdam
              6 Posts
              ACCEPTED ANSWER

              Re: ACL out of date - CM8

              ‏2010-01-05T12:32:32Z  in response to JavaAdam
              Hello again,

              i have tried to call DKDatastoreICM.clearCache(DKDatastoreICM.DK_CM_CLEAR_CACHE_ALL) via a Plug-In before recieving the ACL. Further I have called Content.setAccessControlList(null) before the refresh for flushing the CIEE cache. But it didn't help. The ACL is still out dated. Can someone confirm or deny this behavior?

              p.s. I know that if clearCache does not work I should ask about this in the II4C forum.... But perhaps someone has an idea here?

              Thanks
              Adam