Default User Group for JIRA Software Constantly Removed from Application Access Page

Shirley He

Hi all,

Today users on my Jira instance suddenly had troubles logging in and I found out that it was because supposedly no user was using one out of 2000 licenses. I looked in the Application Access page and saw that no group was listed under the Jira Software heading, I fixed the problem by adding the user group back and setting it to default, but I'd like to know if anybody knows why this has happened in the first place? It's happened 3 times already today.

Thanks

Andy Heinzer

Are you using an LDAP directory with Jira in order to get both users and groups into Jira?  If so, there is the possibility that if when Jira tries to sync the groups that exist, if that sync fails, the group that you're using to grant application access can be removed from the system.   I have seen this happen before, but it tends to only happen in environments that are trying to sync several thousand or hundreds of thousands groups (usually far more groups than are actually ever used in Jira).   The same can happen for user objects as well, but when this happens, users don't appear in Jira, but the groups shouldn't necessarily be removed as well.

If you are seeing problems with the LDAP sync, you should be seeing errors in the $JIRAHOME/log/atlassian-jira.log file when the sync is happening.  It might be best to look in that log first to better understand if this is really what is happening in your system before going any further.

If your environment is reflected by this scenario, then it might help to take a closer look at the LDAP filter Jira is using to restrict which groups are actually getting synced into Jira.  And then trying to follow the KB How to write LDAP search filters in order to reduce the groups to only sync over the groups needed for application access and permission/notification/security schemes.

If that method isn't helpful, then there are other possible ways to get around this.  One of these is use a delegated LDAP directory instead of a connected LDAP directory.  In this setup, Jira doesn't sync changes, more details in Synchronizing data from external directories.