Removing users from groups through SQL

[TomB]

I am trying to remove a group of users in bulk from the jira-users group through SQL (since there doesn not seem to be a way to do this through the UI). I am deleting the row in cwd_membership where the child_name = 'user's id' and parent_name = 'jira-users'. After running this query, the UI does not reflect the update until I add that user to another group, then the groups update in the UI as expected. 

Question: When you remove a user from a group in the UI, is it touching more tables than simply deleting the corresponding row for that user/grou pairing from cwd_membership table?

[Nic Brough -Adaptavist-]

Yes, you need to stop JIRA, take a backup, run your SQL, restart JIRA and re-index it.

This is one reason you don't do anything with SQL in Atlassian applications.

[TomB]

Thanks for the reply, Nic. Just to clarify...are you suggesting that I do not make any modifications to group membership through SQL...or are you saying that this will work as long as I go through the process of stopping JIRA first, etc.?

[Nic Brough -Adaptavist-]

Both.  I can not recommend the use of SQL updates on a JIRA database, as they almost always cause problems because people don't understand the database.

If you insist on using them, then you *must* have JIRA offline when you do it, and a proved backup, as it's not unknown for one tiny mistake to render chunks of the application totally broken.

There are some exceptions to the "offline and re-index afterwards" rule, but not many.

[Susan Hauth _Jira Queen_]

I need to do something similar and it's been advised to use the REST API.  @Nic, working on it with @Antonio at Adaptavist

[Nic Brough -Adaptavist-]

My apolgies, I was too focussed on the SQL.  Yes, absolutely do it with REST.

I think of REST as a "UI for computers" - if a human clicks on "delete user from group" and something makes a REST call to "delete user from group", they both take much the same route through the code, and end up removing the user in the same safe way that doesn't need any downtime.

[M Hoogenboom]

Scriptrunner has an example to deactivate a user in JIRA, but that doesn't work with users from an LDAP directory. I get an error saying that "Cannot edit user, as the user's directory is read only", although the users directory is read only, it should be able to change the local groups (remove jira-users). I now found a solution with curl and REST API to remove the users from the jira-users.