Infinite loop when installing user group package

[B_Wulteputte]

I have an environment which was upgraded to AEM 6 (SP2 + oak 1.11) from CQ5.5 (SP3).

When I now package the groups on that instance and try to install them on my local machine, I get an infinite install loop. This is made clear by the log messages which keep attempting to process non existing authorizables. I only want the group structure and not the userdata. So I expected behaviour as it always was (BESTEFFORT). Unfortunately, it states it's doing best effort, but AEM tries to fully import each group sequentially, when it's reached the last group, it start's over with the first group, and so on, hence the infinite loop.

An example output is shown below:

16.02.2015 10:55:50.358 *WARN* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter New member of Group 'clients': No such authorizable (NodeID = ffef53f9-bcde-3387-ace3-13522e79934b)<

16.02.2015 10:55:50.358 *INFO* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter ImportBehavior.BESTEFFORT: Remember non-existing member for processing.

16.02.2015 10:55:50.358 *WARN* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter New member of Group 'clients': No such authorizable (NodeID = fff33889-171a-3502-a7fd-3a460dc7a8fd)

16.02.2015 10:55:50.358 *INFO* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter ImportBehavior.BESTEFFORT: Remember non-existing member for processing.

16.02.2015 10:55:50.359 *WARN* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter New member of Group 'clients': No such authorizable (NodeID = fff9cca2-5e06-384b-bbc4-1200d44841a2)

16.02.2015 10:55:50.359 *INFO* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter ImportBehavior.BESTEFFORT: Remember non-existing member for processing.

16.02.2015 10:55:50.360 *WARN* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter New member of Group 'clients': No such authorizable (NodeID = fff9f699-7436-36bd-8798-d77d23b2f56a)

16.02.2015 10:55:50.360 *INFO* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter ImportBehavior.BESTEFFORT: Remember non-existing member for processing.

16.02.2015 10:55:50.360 *WARN* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter New member of Group 'clients': No such authorizable (NodeID = fffc5405-fa26-3762-8071-74494cd336ce)

16.02.2015 10:55:50.360 *INFO* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter ImportBehavior.BESTEFFORT: Remember non-existing member for processing.

16.02.2015 10:55:50.360 *INFO* [qtp481007721-40] org.apache.jackrabbit.oak.security.user.UserImporter ImportBehavior.BESTEFFORT: Found 21190 entries of rep:members pointing to non-existing authorizables. Adding to rep:members.

If I wait long enough I do get an error, but it's unclear in the context of my 130 groups

16.02.2015 10:57:40.539 *INFO* [qtp481007721-40] org.apache.jackrabbit.vault.fs.io.AutoSave Threshold of 1024 reached. saving approx 190 transient changes. 0 unresolved

16.02.2015 10:57:42.518 *ERROR* [qtp481007721-40] org.apache.jackrabbit.vault.fs.io.AutoSave error during auto save - retrying after refresh...

16.02.2015 10:57:44.833 *ERROR* [qtp481007721-40] org.apache.jackrabbit.vault.fs.io.Importer Error while committing changes. Aborting.

16.02.2015 10:57:44.834 *ERROR* [qtp481007721-40] org.apache.jackrabbit.vault.packaging.impl.ZipVaultPackage Error during install.

javax.jcr.nodetype.ConstraintViolationException: OakConstraint0025: Authorizable property rep:authorizableId may not be removed.

Can someone please advise me? I don't want to have to add 130 groups manually and interlink them manually while a regular package should do the job.

[aheim02]

Can you supply some details about the definition of your package? Eg the filters and inclusions/exclusions.

[B_Wulteputte]

I only have one single filter which is set to /home/groups, no specific inclusions or exclusions. The most simple form of a content package basically, just one path and that's it.

[Dinu_Arya]

Hi,

It's better to include entire path in filter.xml instead of parent of the groups. If you give like this, it will try to install all the nodes which are there under "/home/groups". If you are giving the filter with parents folder, make sure you have used mode="merge" option for the filter. If you set to the filter in filter.xml to exact group path e.g. "/home/groups/c" or "/home/groups/c/contributor". If we do like this, only the related nodes will be installed. May I know the installed nodes count? It will be visible in the activity log after installation. If your package contains more than 1024 nodes, I think the remaining nodes might not be installed. You can check the threshold limit at -

• Click on "Install" option beside the package
• Expand "Advanced Settings".
• "Save Threshold". You can set the limit here. But I'm not sure how it will impact. Need to check with Adobe people.

Thanks,

AryA.

[B_Wulteputte]

Hi Arya

I disagree with the assessment that that I should use mode="merge" and that I should link to individual user groups rather than the common parent. I only want the groups that are actually available on the upgraded instance. I actually want to lose groups I have locally which are not in the package. I want to have the exact same group and folder structure locally as I have on the remote instance. I don't see how mode="merge" will achieve this.

I also think the success of installing a package should not depend on the mode used while installing. The installation should either fail miserably with clear errors or just install. The case I'm dealing with here does neither. 

And to answer your initial question. In the end nothing got installed (none of the groups I expected to see were available) - although some auto thresholds were triggered along the way which seemed to be successful. I didn't see anything in the logs that would indicate a revert of those auto saves, but the result wasn't there.

The interesting part is that if I build the exact same package on a 5.5 SP3, it does install successfully on my AEM 6 locally without the infinite looping. And if I then install that same groups package I initially had troubles installing, it does complete (and doesn't loop infinitely). So I'm completely in the dark why it did work after 5.5 package was installed first. So at this point, I do have what I want, but it remains a strange case to me. Anyway, I'm gonna retry this setup this weekend to verify some observations.

EDIT: after a successful installation this is the installed node count: saving approx 185 nodes... 

Checking the original looping log however, I have about 220 lines saying things like this (with varying transient changes count): 
org.apache.jackrabbit.vault.fs.io.AutoSave Threshold of 1024 reached. saving approx 1025 transient changes. 0 unresolved 

this seems to be a lot more than the one upon successful installation: 
org.apache.jackrabbit.vault.fs.io.AutoSave Threshold of 1024 reached. saving approx 185 transient changes. 0 unresolved"

[Sham_HC]

There are couple of changes between 5.5 & 6.  You need to follow some tricks & mentioning below I could remember so far.

1)  Make sure you exclude admin user in the package.

2)    Make sure to exclude all the login token of the user.

3)    Make sure to include only the user that does not exist in aem6.

[B_Wulteputte]

Hi Sham

Although I'm aware of some (not all) differences between 5.5 & 6. I'm trying to install a package containing only groups not users. So the question becomes, are there any similar rules for groups to keep in mind?