This issue is derived from two related JIRA and Confluence issues, JRA-12675 and CONF-13800 respectively.

The problem seems to stem from the way that lists of LDAP group names are serialised to strings. These group names may include commas, either straight 'mygroup, more' or escaped 'mygroup\, more', and code using the attribute DirectoryImpl.ATTRIBUTE_KEY_AUTO_ADD_GROUPS is converting pipe char '|' separators to comma ',' separators in code like EMBCWD's DefaultDirectoryMapper.pipeSeparatedGroupsToCommaSeparatedGroups method.

Ideally, lists of groups would be passed around as lists as much as possible and only serialised to a string at the point of storage in the DB, but refactoring this with API support throughout the affected products will be a substantial task.