Summary

Nested groups with uppercase letters cannot be removed from Confluence, after having been synced initially.

If you synchronize nested groups with upper case letters into Confluence from Crowd / LDAP, and then update the external directory to remove the child groups, the groups will not be removed from Confluence.

Steps to Reproduce

1. Create a nested group in LDAP
2. Have either the parent, child group, or both contain any number of upper case letters
3. Sync with Confluence
4. Confirm the nested memberships show up
5. Remove the child group from the LDAP parent group
6. Sync with Confluence
7. Nested memberships are not removed

Expected Results

Confluence should match the external directory

Actual Results

Confluence retains this group membership until the directory is recreated

Notes

Crowd does pick up the group changes from LDAP. However, Confluence will not be in sync with Crowd when this occurs.

There is a bug in the Confluence internalFindAllGroupMemberships() function from com.atlassian.crowd.embedded.hibernate2.HibernateMembershipDao#removeGroupFromGroup. It will prevent nested groups from being removed from their parent in any sync if the parent group name contains upper case characters.

Workaround

Remove the directory and recreate it