Administrator account lost group membership on upgrade


I've performed an upgrade from JIRA 6.0.8 to JIRA 6.2.7 in our test enviroment. Once the upgrade finished I signed in with our admin account (JIRA Interna Directory). Here I notice that I've lost all admin permissions(membership to system administrator group) on this account. I signed in with another account and tried to re-add these permissions and received an "duplicate key"-error. Ran the following sql on the database:

select * from cwd_membership where parent_name='jira-administrators'

(where I replaced the jira-administrators with the name of my system administrator group) and my admin account showed up in the result. It seems as if the account has the permission assigned but that JIRA somehow can't find it.

This error did not occour on all accounts in JIRA Internal Directory, only this account. The error, as far as I can tell, didn't seem to affect the accounts from our Active Directory.

I've done the basic restart of JIRA but that didn't help. Any suggestions on what might have caused this error and how to solve it is appreciated.


2 answers

0 votes

Is there another account in your AD with the same user name? If so, that might be overriding your internal user account depending on how the directories are ordered.

The JIRA Internal Directory is first in line. I will ask the AD-guys if there is an AD-account with the same name just to rule that option out, but I don't think so. All of this worked just fine before the upgrade.

Just got the answer from the AD-guys, there are no AD-account with the same user name.

Your DB might be corrupted somehow. You can try what is described here:

I've looked at that article, that's where I got the SQL query. I know which account is the admin account and I know the password. I can see that the user, according to the db, has system administrator permission. However, when I look at the account in User Management, that Group is not mapped to the user. My guess is, as you say, that something is wrong with the db. I have raised a support ticket at Atlassian to see if they have any idea how this can be solved.

After looking at the table rows in the db more carefully I could see that there was a difference in lower_parent_name column between my admin account and other JIRA Internal Directory accounts. Even though they should be in the same Group according to the value in the parent_id column, the value in the lower_parent_name was different.

To solve this problem I stopped JIRA, updated the value in the lower_parent_name column to match the other JIRA Internal Directory account. After that I started JIRA and everthing worked fine. I was in contact with Atlassian before I did this and this was the solution that they recommended. Remember to try this in a staging enviroment before you do this in production.

My guess is that JIRA performes a join between the tables cwd_membership and cwd_group but not on the ID column. Instead they join on the lower_parent_name.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Nov 27, 2018 in Portfolio for Jira

Introducing a new planning experience in Portfolio for Jira (Server/DC)

In the past, Portfolio for Jira required a high degree of detail–foresight that was unrealistic for many businesses to   have–in   order to produce a reliable long-term roadmap. We're tur...

2,562 views 15 21
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you