Confluence not syncing group deletions or name changes from Crowd

[Ed Jackson]

We use Crowd as a user directory for Confluence. We have recently done quite a bit of work cleaning up groups in Crowd, as a lot of cruft had grown up over time.

While membership changes and new groups seem to be propagating correctly from Crowd to Confluence, group deletions and group name changes are not. The sync consistently reports success.

Changes are being correctly propagated to Jira and Bamboo.

I am at a loss on how to start diagnosing this, so any help would be welcome. We are using Crowd 2.6.4 and Confluence 4.3.3 (yes, I know, we need to update).

Thanks.

Edit: We have (finally) upgraded to Confluence 5.4.1 and we are still seeing this issue. I hesitate to try the proposed workaround until I have some reassurance that it's non-desctructive.

[Sorin Sbarnea (Citrix)]

If you are using PostgreSQL backend this could be a workaround for making the sync work again. 

begin;
DELETE from cwd_membership where child_user_id in (
SELECT id from cwd_user where external_id IN
(
SELECT external_id
        FROM cwd_user
        GROUP BY external_id, directory_id
        HAVING COUNT(*) > 1
) 
ORDER BY external_id, ID 
LIMIT 1
);
DELETE from cwd_user where id in (
SELECT id from cwd_user where external_id IN
(
SELECT external_id
        FROM cwd_user
        GROUP BY external_id, directory_id
        HAVING COUNT(*) > 1
) 
ORDER BY external_id, ID 
LIMIT 1
);
commit;

[nikhil khedlekar]

A full sync can also be triggered by a Confluence app reboot rather than disabling Crowd directory. This resolved the issue for me - where some changes I had made to a user in Crowd (talking to AD) were not flowing back to Confluence.

[Philip Colmer]

I'd like to add that we're seeing this problem with JIRA as well but Tiago's suggested workaround does solve the problem. That said, it would be good if the problem didn't occur in the first place because typically the first time we know the problem has occurred is when it is affecting a user and that is not a good thing!

[Matthew Olds]

Has Ed's question been answered? I may have to do the same thing, and want to make sure there are no issues.

[Tiago Comasseto]

Hi Ed, is there any error in your Confluence log? Have you tried to force a full synchronization (not incremental)? If not, this case be done by disabling Crowd directory in Confluence, enabling it again and synchronizing the directory again.

Cheers

[Ed Jackson]

Thanks for the quick response! There's nothing in the log that looks like an error, and there is a call to deleteCachedGroupsNotIn. It is finding the correct number of groups on the Crowd server, but there are still considerably more in the local list in Confluence. Will disabling the Crowd directory and re-enabling it cause any problems with permissions and document ownership when the users and groups (temporarily) disappear?