Deleted user accounts and ClearCase performance

Symptom

Overview

The -nusers switch is available for cleartool subcommands, such as lock and mktrype, to create an exception list for objects in a Rational ClearCase VOB.

A username that is included on an exception list is granted rights to modify the object, while users that are not on the list cannot modify the object.

When the object is changed, ClearCase checks the authenticity of the user running the operation as well as all other users that are specified in the -nusers list, even accounts that have been deleted in the environment.

Deleted user account

When a user account is removed from the environment without first being explicitly removed from the exception list of an object, then it remains on the list. There is no update sent to or captured by ClearCase to remove the account from exception list.

In this situation, though the username is no longer valid, it still requires authentication when the VOB object is modified.

As expected, the lookup attempt for an invalid account is unsuccessful, but the remote procedure call (RPC) takes several moments longer to return than if the account was still available in the environment. Hence, this will increase the time it takes for the ClearCase operation to complete.

Since ClearCase does not cache negative failures (or failed lookup attempts), each time an operation is performed against the VOB object, the lookup will occur for any deleted account in the -nusers list.

Note: The delay will vary from environment to environment due to unique configurations, and in some cases, the operation can fail as seen in some of the below examples.