OIDC Performance Improvement and Solution for Constraint Violation

[akhilraj]

Hi,

We have implemented the Azure OIDC auth mechanism for our internal AEM site.

Normal functionalities are working fine, including:

1. User creation if not present
2. Adding to groups
3. Adding the properties
4. Updating properties
5. User logout

However, we encounter the following errors when the load is high.

09.09.2025 08:05:40.550 *ERROR* [qtp1259476332-8844] OIDCAuthenticationHandler Exception occured in extract credentials of Circuit OIDC Authentication Handler :: javax.jcr.nodetype.ConstraintViolationException: OakConstraint0030: Uniqueness constraint violated property [jcr:uuid] having value c04a62db-b08a-3fcd-9da4-82fa487cbd7e: /home/users/7/7rlCyphwMn-XTm_MPlHp, /home/users/-/-Plc_ry19_nkYAn02zmw

OIDC Authentication Handler :: javax.jcr.InvalidItemStateException: OakState0001: Unresolved conflicts in /home/users/8/8Q1wHuNaDigZHD6Bt79M/oidcTokens

Line 6263: at com.intel.circuit.services.sso.services.CircuitOIDCAuthenticationHandler.extractCredentials(CircuitOIDCAuthenticationHandler.java:201)

Do you have any suggestions for resolving these issues?  The user creation and all other actions are single-threaded for individual users. 

Also kindly suggest possible improvements as well?

[SantoshSai]

Hi @akhilraj,

There are 2 things from your error log

1. Two different user home nodes ended up with the same jcr:uuid. That only happens when concurrent/duplicated creation or a copy/import preserved a UUID it shouldn’t.

2. Two (or more) requests tried to write the same user node/property at the same time; Oak detected a write conflict.

Try to impleent Sticky sessions for the login flow: Ensure LB/Dispatcher routes all requests in a given login to the same AEM node (callback, profile write, group add, token save). This alone eliminates the bulk of cross-node races.

About jcr:uuid: If you copy any templates/nodes for users, make sure the API generates a new UUID (no “keep UUID” imports/copy).

At the end find and cleanup duplicate UUIDs under /home/users 

[HrishikeshKagne]

Hi @akhilraj ,

Your errors come from race conditions under load - multiple threads/processes trying to create or update the same user nodes at once.

Use UserManager + synchronized logic (or Oak IDP caching) to ensure only one thread handles user creation/update.

Add retry logic for ConstraintViolationException/InvalidItemStateException.

Offload heavy property/group updates to an async job instead of inline in the login flow.

Keep oidcTokens in a separate service/user-specific node or external cache to avoid JCR conflicts.

Enable Jackrabbit User Synchronization (SyncHandler) configs (factory PID org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncHandler) with proper uniqueness rules.

Serialize user creation, add retry handling, move token writes out of login, and tune sync handler configs. This removes constraint violations and boosts performance.