Cannot remove user(s) from certain group membership(s)

Symptoms

During the removal of a certain group(s) in JIRA user(s), JIRA would not process the command and act like there are no process done as the group membership is not removed. There are no stack traces thrown by JIRA during the whole process.

• In order to confirm that this is the issue, please try to remove another groups on that particular user and see if it is successful.

• This issue usually appear on a deleted user_name(s) that re-added into JIRA.

Cause

1. Jira did not completely delete all of the necessary user rows on cwd_membership. See the relevant bug report regarding this issue: JRASERVER-25611 - Unable to modify group memberships for re-created users

2. The user is associated with the incorrect group's ID in the cwd_membership table.

Diagnosis and Resolution

Cause 1:

1. Identify the problematic user_name

2. Run the following SQL query against JIRA database

   1 SELECT ID,child_id,parent_name,child_name,directory_id FROM cwd_membership WHERE lower_child_name='<problematic user_name>';

   The query will list down all of the membership under the problematic user_name

3. From the result of the above steps, ensure there is a different child_id with the same directory_id before proceed to the next steps. If there are no multiple child_id, this is not the issue

4. Remove the problematic row(s) by executing this SQL query against JIRA database

   1 DELETE FROM cwd_membership WHERE child_name = '<problematic user_name>' AND child_id NOT IN (SELECT id FROM cwd_user WHERE user_name = '<problematic user_name>')

   The above command would delete all rows relevant to the offending child_id value which comes from the undeleted rows

5. Restart JIRA

Cause 2 :

1. Identify the problematic group_name and user_name.

2. Run the following SQL Query on the JIRA Database:

   1 SELECT id,group_name,active,directory_id FROM cwd_group where group_name='<problematic group_name>';

   This will list the information of the group details for each directory.

3. With the result from the above query, take note of the id and directory_id as it will be needed later.

4. Next, Run the following SQL query against JIRA Database:

   1 SELECT ID,parent_id,child_id,parent_name,child_name,directory_id FROM cwd_membership WHERE child_name='<problematic user_name>';

   The query will list down all of the membership under the problematic user_name.

5. Compare the parent_id and directory_id values return from the second SQL query against the values of id and directory_id return in the first SQL query. If the value is exactly the same, this is not the issue.

6. If the value of parent_id(cwd_membership) and id(cwd_group) have the same value but it is not reflecting the directory_id value this means it is mismapped.

   Example: In table cwd_group the group with id = '10000' is associated to directory_id = '1'. But in cwd_membership for that problematic username, the parent_id = '10000' is associated to directory_id = '2'.

7. Run this select and save the results:

   1 SELECT * FROM cwd_membership WHERE directory_id = '<mismapped value>' AND parent_id NOT IN (SELECT id FROM cwd_group WHERE directory_id = '<mismapped value>');

8. Remove the problematic row(s) by executing this SQL query against JIRA database:

   ⚠️ If groups in the output from 7 are related to application access, be mindful it may cause users to lose application access.

   1 DELETE FROM cwd_membership WHERE directory_id = '<mismapped value>' AND parent_id NOT IN (SELECT id FROM cwd_group WHERE directory_id = '<mismapped value>');
   The above command would delete all groups that have the mismapped directory_id.

9. Restart JIRA.