Cache user/roles in Jackrabbit security manager

[lgpl/argeo-commons.git] / security / runtime / org.argeo.security.jackrabbit / src / main / java / org / argeo / security / jackrabbit / ArgeoSecurityManager.java

diff --git a/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java b/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
index efd19b87d6a7e22539208a32a3d81dacf03a5d0e..244207bc59dd6f80cb838296cb3eece79531abd7 100644 (file)
--- a/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
+++ b/security/runtime/org.argeo.security.jackrabbit/src/main/java/org/argeo/security/jackrabbit/ArgeoSecurityManager.java
@@ -17,8 +17,11 @@ package org.argeo.security.jackrabbit;
 
 import java.security.Principal;
 import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 
 import javax.jcr.RepositoryException;
@@ -43,6 +46,10 @@ public class ArgeoSecurityManager extends DefaultSecurityManager {
        private final static Log log = LogFactory
                        .getLog(ArgeoSecurityManager.class);
 
+       /** TODO? use a bounded buffer */
+       private Map<String, String> userRolesCache = Collections
+                       .synchronizedMap(new HashMap<String, String>());
+
        /**
         * Since this is called once when the session is created, we take the
         * opportunity to make sure that Jackrabbit users and groups reflect Spring
@@ -71,12 +78,25 @@ public class ArgeoSecurityManager extends DefaultSecurityManager {
                else
                        authen = authens.iterator().next();
 
+               String userId = authen.getName();
+               StringBuffer roles = new StringBuffer("");
+               GrantedAuthority[] authorities = authen.getAuthorities();
+               for (GrantedAuthority ga : authorities) {
+                       roles.append(ga.toString());
+               }
+
+               // do not sync if not changed
+               if (userRolesCache.containsKey(userId)
+                               && userRolesCache.get(userId).equals(roles.toString()))
+                       return userId;
+
                // sync Spring and Jackrabbit
                // workspace is irrelevant here
                UserManager systemUm = getSystemUserManager(null);
                syncSpringAndJackrabbitSecurity(systemUm, authen);
+               userRolesCache.put(userId, roles.toString());
 
-               return authen.getName();
+               return userId;
        }
 
        /**