Issue Summary

New users added on LDAP are not listed on the Assign user picker, although the "Permission helper" confirms that they have assignable permission.
The same user can be used without problems by other User Pickers such as Reporter, Approval, Watcher, or Mention.

Environment: Jira DC 8.20.13, embedded Crowd, MS Active Directory with nested groups.
 

Observed behavior:

• We can fully type the user, but the user picker for the assignee does not find the user;
• We can confirm that the user is a member of an LDAP with nested group enabled, the parent group was mapped on the project for a role with assignable permission;
• Sync was done with LDAP, the user was a member of the correct groups;
• If we remove and add back the user on LDAP, the sync is done, user caches flushed, but the issue remains;
• Permission helper shows that the user is an assignable user;
• The same user can be used without problems by other User Pickers such as Reporter, approval, Watcher, or Mention.

Steps to Reproduce

(not reproduced on our site)

1. New user "userdummy" added as a member of an inner nested group (for instance, 3 levels of groups);
2. The parent group mapped on Jira to a project role with "assignable" permission;
3. The user search filter is following the KB Active Directory User Filter Does Not Search Nested Groups;
4. There are more than 100 groups in each nested group, each group with high number of users.

Expected Results

The Assignee user picker should list the user when typing the username.

Actual Results

The Assignee user picker doesn't list the user even after fully typing the username.

Using com.atlassian.jira.crowd.embedded.QueryDslJiraCrowdDAO=TRACE, the user search returns the following result:

2023-04-11 13:23:12,060-0700 http-nio-127.0.0.101-8081-exec-22 TRACE xxx 803x3263x1 1gxdhtb   /rest/api/latest/user/assignable/search [c.a.j.crowd.embedded.QueryDslJiraCrowdDAO] JiraCrowdDAO#findTopUsersWithNameInGroups: input.searchName:userdummy, input.groups.size:43, input.topN:100, dbResult.size 0, result.size:0, timeInMillis:22 

Workaround

Option 1: Add directly the inner nested group "group3" to the mapped role on the project instead of using the top group "group1";

Option 2: Add directly the user to the mapped role on the project;