Handle user create race condition #20097
Conversation
|
@miq-bot add_label bug |
|
@jvlcek Cannot apply the following label because they are not recognized:
All labels for |
|
@bdunne Please review |
jvlcek
force-pushed
the
multi_user_race_ISSUE_20041
branch
from
fad59df
to
40de431
Compare
jvlcek
force-pushed
the
multi_user_race_ISSUE_20041
branch
from
a3301c3
to
49e37d0
Compare
|
Checked commit jvlcek@49e37d0 with ruby 2.5.7, rubocop 0.69.0, haml-lint 0.28.0, and yamllint |
| @@ -137,7 +137,18 @@ def authorize(taskid, username, *args) | |||
| end | |||
|
|
|||
| user.lastlogon = Time.now.utc | |||
| user.save! | |||
| if user.new_record? | |||
There was a problem hiding this comment.
I like that we only lock on a new user, which should ideally be less common than just logging in. This is great!
|
@jvlcek @abellotti I think this bug has been around a while...should this be backported to ivanchuk as well? |
|
@Fryguy Thank you for merging. Yes it probably should go to ivanchuck as well. |
|
@miq-bot add_label Ivanchuk/yes |
Handle user create race condition (cherry picked from commit 5906889)
|
Jansa backport details: |
Fixes #20041
When a user's credentials are used to access ManageIQ for the first time, if properly configured, the user record will be created in the ManageIQ database.
It is possible when multiple simultaneous attempts to access ManageIQ for the first time with a single user name that a race condition could result in multiple user records being created for the same user.
This PR addresses this race condition by placing a lock on the User table when attempting
to create a new user. If a duplicate user record is found at this time it means a different simultaneous login attempt has been completed before the current one. To avoid raising a duplicate userid error this condition is rescued and handled by attempting to update, the existing user record instead of creating a new on.
Steps for Testing/QA [Optional]
Configure ManageIQ for external auth, with get user groups from Identity Provider selected.
Perform multiple simultaneous attempts to access the ManageIQ API with a username and password for a user that is not yet in the database.
This can be done with a shell script that issues multiple simultaneous curl commands to query ManageIQ.
e.g.: Repeat the below line multiple times in a shell script and run the shell script simultaneously from multiple shell windows