Issue Summary

When a user's group memberships are updated on login for a delegated user directory, using the "Synchronize group memberships" option, the following method is called:

com.atlassian.crowd.directory.DelegatedAuthenticationDirectory.importGroupsAndMemberships

This results in insert and delete operations that invalidate the group membership Hibernate query cache. The entire group membership query cache is invalidated, for all users. This results in any subsequent user->group membership queries going directly to the database until the cache is repopulated. With frequent group membership modifications, the high frequency of these cache invalidations significantly increases database load.

Steps to Reproduce

1. Login as user A who has no memberships to be updated. Note the number of selects to the following tables:

   cwd_membership
   cwd_group
   cwd_user
   

2. Login as user B, who has a large number of group memberships to update, and confirm memberships are updated for this user.
3. Login again as user A. Note again the number of selects performed on the Crowd tables.

Expected Results

Database performance when "Synchronize group memberships" is enabled should be similar to when it is disabled.

Actual Results

Database performance is substantially worse with "Synchronize group memberships" enabled, due to the high frequency of cache invalidation.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available.