When connecting JIRA to a Crowd server, we will auto-synchronise the user and her group memberships if the user was previously unknown.
On the other hand if the user was already known we don't update the group memberships on login, we just wait until next synchronise to update this.

The main reason this is a problem is that the user may have been added to groups "on the fly" during authorisation with the Crowd server.

See JRA-26882 for a discussion.