Asset Share search results breaking for users in specific user group

[laniweisbart]

We are using Asset Share.  Our search results component pulls assets from 2 different asset folders - we'll call them FolderA and FolderB.  Each of these folders has been assigned permissions via Closed User Groups.  The permissions are assigned like this:

FolderA has 3 Closed User Groups - Group1, Group2, Group3. 

FolderB has 2 Closed User Groups - Group1, Group2.

All of a sudden, we are getting an error upon login only for users who are assigned to Group3 (in other words they don't have permission to view assets in FolderB).

On the front end we're seeing this:

In the logs I am seeing the same query regardless of whether a user is assigned to Group3 or not.

When it is a user assigned to Group3 who logs in, the logs show this and the site displays the error above (because the search is not returning results):

Index-Traversed 10000 nodes with filter... 
Index-Traversed 20000 nodes with filter... 
Index-Traversed 10000 nodes with filter... 
Index-Traversed 20000 nodes with filter... 
Index-Traversed 30000 nodes with filter... 
Index-Traversed 40000 nodes with filter... 
Index-Traversed 30000 nodes with filter... 
Index-Traversed 50000 nodes with filter... 
Index-Traversed 40000 nodes with filter... 
Index-Traversed 50000 nodes with filter... 
Index-Traversed 60000 nodes with filter... 
Index-Traversed 60000 nodes with filter... 
Index-Traversed 70000 nodes with filter... 
Index-Traversed 70000 nodes with filter... 
Index-Traversed 80000 nodes with filter... 
Index-Traversed 80000 nodes with filter... 
Index-Traversed 90000 nodes with filter... 
Index-Traversed 100000 nodes with filter...
The query read or traversed more than 100000 nodes.
org.apache.jackrabbit.oak.query.RuntimeNodeTraversalException: The query read or traversed more than 100000 nodes. To avoid affecting other tasks, processing was stopped.

When it is a user assigned to Group1 or Group2 who logs in, the logs show this and the site loads fine:

Index-Traversed 10000 nodes with filter...
Index-Traversed 20000 nodes with filter...
Index-Traversed 30000 nodes with filter...
Index-Traversed 40000 nodes with filter...
Index-Traversed 50000 nodes with filter...
Index-Traversed 60000 nodes with filter...
Index-Traversed 70000 nodes with filter...
Executed query statement:....

The only change we have made to the environment recently is that we added a set of 20 subassets to each video asset.  So there are quite a few subassets in the environment now.  However, the users with the more limited access (i.e. should have less search results) are the ones seeing the issue.

Has anyone seen something like this and can help point me in a direction to fix it?

[Tethich · Accepted solution]

Hi @laniweisbart 

I see a couple of things:

- one is an issue with maybe too many assets that need to be traversed by your logic

- the other looks like an HTL error within a component of yours.

Maybe the second derives from the first, assuming that the traversal error does not allow your logic execution to finish properly which then makes your component encounter an edge case where operands become not of the same type:

For each issue checkout these threads, maybe you get some inspiration:

- https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/how-to-reduce-huge-content...

- https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/operands-are-not-of-the-sa...

[anupampat]

Hi @laniweisbart ,

The CUG is applied on permissions to access the folders, while a query will traverse regardless of permissions. Adding the subassets have definetly added the query's load and hence you see the errors. You should check for any property within these assets which are being queried by your logic and add them to index.

The error screenshot could be because of a metadata on the new assets being of a data type other than what your query is looking for.

Regards,

Anupam Patra

[laniweisbart]

We have our search results component set to exclude sub-assets:

Can you help me understand why the number of sub-assets would still come in to play?  And also why it would only error out for users with one specific user group?