Summary

High memory usage for Closed Service Desk projects with Group Anyone permission

Environment

• Instance with a large number of users (100K+)

Steps to Reproduce

1. Create ServiceDesk project with following settings:
   • ServiceDesk access permission: Closed
     • we can check by running /rest/servicedesk/1/servicedesk/<PRJ>/settings/requestsecurity
       
   • ServiceDesk project permission: add Group Anyone (which is almost equal to Open SD)
     
2. trigger the REST call [/rest/servicedesk/1/servicedesk/sd-user-search/participants?issueKey=SDPRJ-2&query=admin]

Expected Results

Low memory allocated by Service Desk thread

Actual Results

High memory allocated by Service Desk thread (1GB+), which may lead to heavy JVM memory pressure and OOM

Notes

• When servicedesk is closed and "sd.use.search.by.permissions" feature flag is enabled it load ALL the customers into the memory and then filters them.
  • hit the com.atlassian.jira.security.type.GroupDropdown.getUsers() which calls com.atlassian.jira.user.UserUtils.getAllUsers()
• KB which we have related to this Closed Access Service Desks, slow user picker search

Workaround

• Disable "sd.use.search.by.permissions" feature flag, see KB
• Remove Group Anyone and make project Open