Crowd and MS Active Directory - Cached user info?

[A]

Crowd 2.3.3 with configured directory MyDir = MS Active Directory

In AD - a user has been moved out of configured "MyDir / User DN" into another one in our tree (smth like terminated users), but still shows up in search results.

I am trying to poke around - see what can I do though the Web interface - for example uncheck "active" flag - Crowd returns with

User <xyz> does not exist

2013-11-07 11:24:39,757 http-8095-16 ERROR [console.action.principal.UpdatePrincipal] User <xyz> does not exist
com.atlassian.crowd.exception.UserNotFoundException: User <xyz> does not exist
        at com.atlassian.crowd.directory.SpringLDAPConnector.findUserWithAttributesByName(SpringLDAPConnector.java:511)
        at com.atlassian.crowd.directory.SpringLDAPConnector.findUserByName(SpringLDAPConnector.java:494)
        at com.atlassian.crowd.directory.SpringLDAPConnector.updateUser(SpringLDAPConnector.java:845)
        at com.atlassian.crowd.directory.DbCachingRemoteDirectory.updateUser(DbCachingRemoteDirectory.java:267)
        at com.atlassian.crowd.manager.directory.DirectoryManagerGeneric.updateUser(DirectoryManagerGeneric.java:352)
        at sun.reflect.GeneratedMethodAccessor2208.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
        at com.atlassian.spring.interceptors.SpringProfilingInterceptor.invoke(SpringProfilingInterceptor.java:20)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
        at $Proxy15.updateUser(Unknown Source) 

help, please?

[Caspar Krieger · Accepted solution]

It sounds like you are using a cached directory (cached connector).

If you are using a cached directory, the user will still show up in Crowd until Crowd does the next sync (assuming the user will be excluded by the newest sync). This usually happens in about an hour but you can trigger it early from the configuration page for the directory.

The failure to find the user when you try to update it happens because when updating a user, Crowd first tries to update it in the remote directory, and only updates it in the local cache if the remote directory update succeeds. There are good reasons behind this: if it wasn't done (i.e. if the local cache was updated first), then it would be possible for the sync to trigger between the time the local cache was updated and the time the remote directory was updated so that the sync overrides the manual changes made in the local cache, causing data to be lost (or, another scenario: if the remote directory is not reachable, then Crowd would be causing its cached data to diverge from the remote directory, which is something we try to avoid happening).

Anyway, I suspect the problem has probably fixed itself by now, but if it hasn't, try manually synchronising the cache for your directory.

You might also be interested to know that the latest Crowd (2.7) has sync'ing support for Active Directory's user status flag, so that a user disabled in Active Directory also becomes disabled in Crowd on the next sync.

[A]

well - I tried re-syncing before posting here :)
it did not help though. What eventually worked:

I disabled caching + updated the Directory and re-enabled caching + re-synced.

The user is gone now.
thanks for your input!