Details
-
Suggestion
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
6.0.0
-
None
Description
HPCC-15439 introduced the concept of a shared permissions cache. The implementation may be more restrictive than necessary.
Given the ability to concurrently use multiple security manager classes (as opposed to multiple instances of a single class), with each manager authenticating against a different user base, it is possible for user name collisions to occur. A single cache shared by all managers may not behave as expected when collisions occur. When it doesn't work, either a cache entry will be discarded as invalid, or incorrect user properties supplied by a different user base will be applied to the user.
Each security manager class that supports shared caching should be responsible for instantiating its own static cache. This will ensure that cached content is consistent within the context of each security manager. Otherwise, the limitations inherent to global sharing need to be well documented.