Extremely large Permissions table

Question

Does anyone know if there's an inherent problem with an extremely large permissions table? I'm dealing with a Drupal install with about 50 roles (permissions were set up using taxonomy terms), and there look to be about 800 permissions. So, quick estimates suggests approximately 40000 checkboxes on the permission table. Now, out of all of these, probably only about .1% are actually checked; I know that the role_permissions table only stores the enabled permissions. I don't know how Drupal is checking the permissions though as it goes; obviously, if it were making DB calls for each checkbox to check its status, that would be horrible.

Obviously, this can't be a good thing, but can someone tell me if it's necessarily a bad thing? The connection seems to be timing out before table gets loaded (or at least I think it's timing out; this is my first time using IIS with Drupal, and it's error message is vague, to say the least.) Does anyone have any suggestions beyond "remove unnecessary roles"? (Not that it's a bad suggestion, and I'll probably end up having to recommend it anyway, I'm just looking for additional options.)

Answer 1

No, Drupal isn't making a single DB call per checkbox - that would be suicide :)

Looking at user_role_permissions() should de-mystify the whole thing...all enabled permissions for the given roles (or all roles if none are provided), are lazy-loaded into memory when they're needed, and statically cached for the same request.

It's about as efficient as it can possibly be when you consider how Drupal's permission system works - I doubt you'll be able to squeeze anything more out of it that wouldn't be considered pointless micro-optimising.

As an aside 50 roles is a lot. I've never seen a site with anywhere near that many; if you can reduce the number of those, you'll be doing yourself a great service.