Page Restrictions Performance Considerations

This has been markedly improved in Confluence 3.3. See CONF-16866.

Page Permissions and the Confluence Search Index

Modifying the page permissions requires reindexing all child pages, as well as comments and attachments on all those pages.

The reasons for this:

• Page permissions are stored on every item in the index
• When you search, a filter is applied to all items in the index which prevents you seeing content you don't have permission to see
• If the permission information on attachments wasn't updated when a page permission was changed, users who didn't have permission to view the attachment in Confluence would still see that attachment in the search results as well as some of its content
• To update any record in the index, you need to delete it from the index and re-add it (this is a limitation of Lucene)

Therefore, to update an attachment record in the index, even just to change the permissions, the attachment's content must be reindexed.

Performance Considerations

In the large majority of situations, this design should not be a problem. In large spaces with deep page hierarchies, it might be. Use performance logging for the index flush operation to assess the impact of changing a page restriction - try it on the space's home page, or a page with a lot of children, to see the performance impact of changing a page restriction.

Space Design Considerations

For some space designs, deep page hierarchies may be desirable. If possible, it's recommended to split spaces where it makes sense to do so, according to how your information is organized. One workaround – CONF-7089 – involves opening up access to just a few pages in a mostly-restricted space so as to "open" the space where space permissions close it. This may be a performance concern if the space, and attachments in the space, are large.

Workarounds

There are a few workarounds to consider:

1. Avoid page restrictions on large page hierarchies. If you have a large hierarchy you have to protect differently to other content in the space, consider moving the hierarchy to a new space. (Space permissions are applied in a manner that doesn't have this problem, but having a large number of spaces also causes scaling issues.)
2. Disable page permissions completely. You can do this on a space-by-space basis by not granting the "Restrict" permission in the space permissions screen.
3. Turn off attachment content indexing. See How do I disable indexing of attachments or Configuring Attachment Size for information on how to do attachment types or size limits.

Which Pages Have Restrictions?

A database query to show which pages in your instance have page restrictions:

For page permissions:

For space permissions: