Issue Summary

When we have a user_picker field that receives the username value from a text field, FIRST the automation looks for that value in the user_key, which can lead to an incorrect value set to the user-picker field when the user was set pre-gdpr (when user-key is similar to lower_username in app_user table).
This is reproducible on Data Center: (yes)

Steps to Reproduce

• Create a user (let's call user-a)
• Change in the database the user_key for that user (as seen in pre-GDPR) with the same value as the username (in our example, in app_user table the user_key will be user-a and the lower_user_name user-a).
• Start Jira.
• Go to admin > user management and rename that user username to another string (in our example the username user-a will be renamed to user-a-renamed)
• Create another user but with the same username of the user created in the first step (in our example, create another user but with username user-a).
  At this point notice that we have two different users as the given example 

  user_key	lower_user_name
  user-a	user-a-renamed
  JIRAUSER00010	user-a

• Create an A4J rule that grabs the username value from a text field (as an example in the description) and tries to set it in the user_picker field. (in the example above, in the description we would have the string "user-a" (for the new user, the JIRAUSER00010) that the rule will extract and try to set in the user-picker field.

Expected Results

The new user with a username similar to the text extracted, to be used. In the example, the user with username user-a.

Actual Results

The user with that string as user_key is used. In the example, the user with username user-a-renamed, that has as user_key the user-a.

Workaround

A new user can be created to avoid using the old pre-gdpr ones. Link: https://confluence.atlassian.com/jirakb/how-to-merge-two-users-content-ownership-and-permissions-in-jira-968659640.html .

The user can have the user-key renamed as indicated in this article.

The options above shall be carefully tested in a lower environment before rolling out to production. 

The rules can have a condition to check the users that are affected, once we know this is a rare condition.