Uploaded image for project: 'JIRA Server (including JIRA Core)'
  1. JIRA Server (including JIRA Core)
  2. JRASERVER-27072

JIRA is extremely slow when Nested group is enabled in LDAP

    XMLWordPrintable

    Details

    • Occurrence Factor:
      50%
    • Development Effort:
      XXL

      Description

      We have made mention in the directory configuration page that enabling nested groups in JIRA can cause performance issues. The level of slowness depends on the number of groups, users and the level of nesting. During the cause of support, we have identified that with the following statistics, JIRA is extremely slow to the extend that even viewing issues takes close to two minutes:

      about 7000 users
      about 700 groups
      about 6-7 levels of nesting
      most user belong to the last level of group,few belongs to higher level group.
      

      Upon disabling the nested feature, JIRA becomes stable even with 100 concurrent LDAP users logged in to JIRA. The cause of the performance is attributed to the fact that permissions calculation in JIRA is very expensive and JIRA has a lot of lookups to do when users try to perform operations.

      Workaround for Active Directory

      Please refer to the workaround in CWD-2082 if using Crowd Standalone. Ensure that 'Use nested groups' is also disabled in the user directory in JIRA.

      If you are using Active Directory you can eliminate this problem using filter directives to delegate the nested calculations to the Active Directory server. This is not available for other LDAP servers.

      1. In JIRA, go to System > User management > User Directories.
      2. Edit the user directory that syncs with Active Directory.
      3. In Advanced Settings uncheck the box nested groups
      4. In Membership Schema Settings...
        • Change Group Members Attribute to "member:1.2.840.113556.1.4.1941:"
        • Change User Membership Attribute to "memberOf:1.2.840.113556.1.4.1941:"
        • Check the box for Use the User Membership Attribute ... When finding the user's group membership (in other words check both checkboxes)
      5. Save the changes
      6. Perform a full synchronization of the User Directory.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                ohernandez@atlassian.com Oswaldo Hernandez (Inactive)
                Reporter:
                smaiyaki Sultan Maiyaki (Inactive)
              • Votes:
                25 Vote for this issue
                Watchers:
                43 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: