I think Solr rights cache could be improved.

Currently, on allowed-groups/denied-groups data, we get the list of the users in the groups.

We should have the name of the group and, in separated data, the list of users in the group.

Like this, if a group is updated (add/remove user), the cache is not re-calculated, only the group description is updated. And the second level cache is clean.

I'm available to give you details about this idea.