Issue Summary

When optimized membership synchronization (AKA fast full synchronization, introduced in Crowd 5.3) is enabled, Active Directory users who have more than 1500 memberships will lose all of their memberships during full synchronization if the directory is configured to fetch memberships through the user membership attribute and nested groups are disabled. This is because Active Directory will return the memberships through a range attribute and Crowd does not support the range attribute for fetching memberships from the user side.

Steps to Reproduce

1. Configure an Active Directory CONNECTOR directory
2. Ensure the AD instance has at least one user who has more than 1500 memberships
3. Enable "Optimize membership synchronization"
4. Enable "Use memberOf for group membership" ("Use the User Membership Attribute -> When finding the user's group membership" in other Atlassian products
5. Perform a full synchronization

Expected Results

The memberships are fetched correctly.

Actual Results

The user does not have any group memberships. The user may regain their memberships in certain cases such as incremental synchronization or synchronizing memberships on authentication. However the memberships will be lost on the next full synchronization.

Workaround

Disabling "Optimize membership synchronization" either through the checkbox or the crowd.use.legacy.ad.membership.syn system property set to true will restore the old full synchronization behavior which does not suffer from this problem. Configuring the directory to not fetch user memberships through the memberOf attribute will also fix the issue as Crowd correctly handles membership ranges for the group member attribute. Enabling nested groups also fixes the issue as it will cause Crowd to fallback to the member attribute if no memberships were found via the memberOf attribute. As nested groups carry a performance penalty enabling them is not a recommended mitigation for this issue.