Exception when adding default group membership

[Uwe Mannl]

Hi there!

We have Confluence running with LDAP user directory (Windows AD). So far everything is working fine.

Now I tried to add an "Default Group Memberships" via LDAP settings. It was empty before, now we wanted to have "confluence-users" as a default group.

But when I click "Save and Test", there is a "System Error".

With empty field, no problem with save and test.

atlassian-confluence.log:

2020-07-29 10:18:26,839 INFO [http-nio-8090-exec-31] [crowd.embedded.admin.ConfigurationController] handleSubmit Configuration test successful for user directory: [ AD Dezernat 3 (ASFRZ) ], type: [ CONNECTOR ]
2020-07-29 10:18:26,840 INFO [http-nio-8090-exec-31] [crowd.embedded.admin.ConfigurationController] doInTransaction User directory updated: [ AD Dezernat 3 (ASFRZ) ], type: [ CONNECTOR ]
2020-07-29 10:18:26,877 ERROR [http-nio-8090-exec-31] [engine.jdbc.spi.SqlExceptionHelper] logExceptions ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated

-- referer: https://CONFLUENCE-SERVER/plugins/servlet/embedded-crowd/configure/ldap/?directoryId=1572866&xsrfTokenName=atl_token&xsrfTokenValue=75728ccc58202a1e3735ec07dc78e120605fce8e | url: /plugins/servlet/embedded-crowd/configure/ldap/ | traceId: 0a79e2ca6eb1b9d3 | userName: atlassian-admin
2020-07-29 10:18:26,878 ERROR [http-nio-8090-exec-31] [org.hibernate.internal.ExceptionMapperStandardImpl] mapManagedFlushFailure HHH000346: Error during managed flush [org.hibernate.exception.ConstraintViolationException: could not execute statement]
-- referer: https://CONFLUENCE-SERVER/plugins/servlet/embedded-crowd/configure/ldap/?directoryId=1572866&xsrfTokenName=atl_token&xsrfTokenValue=75728ccc58202a1e3735ec07dc78e120605fce8e | url: /plugins/servlet/embedded-crowd/configure/ldap/ | traceId: 0a79e2ca6eb1b9d3 | userName: atlassian-admin
2020-07-29 10:18:26,883 WARN [http-nio-8090-exec-31] [confluence.impl.hibernate.ConfluenceHibernateTransactionManager] doCommit Commit failed. Rolling back. Error: Hibernate operation: could not execute statement; sql=n/a; ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated
; nested exception is java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated

-- referer: https://CONFLUENCE-SERVER/plugins/servlet/embedded-crowd/configure/ldap/?directoryId=1572866&xsrfTokenName=atl_token&xsrfTokenValue=75728ccc58202a1e3735ec07dc78e120605fce8e | url: /plugins/servlet/embedded-crowd/configure/ldap/ | traceId: 0a79e2ca6eb1b9d3 | userName: atlassian-admin
2020-07-29 10:18:26,883 WARN [http-nio-8090-exec-31] [confluence.impl.hibernate.ConfluenceHibernateTransactionManager] doRollback Performing rollback. Transactions:
->[PluginReadWriteTx]: PROPAGATION_REQUIRED,ISOLATION_DEFAULT (Session #1233032830)
[com.atlassian.confluence.impl.schedule.caesium.SchedulerClusteredJobDao.delete]: PROPAGATION_REQUIRES_NEW,ISOLATION_DEFAULT (Session #83990004)
[com.atlassian.confluence.impl.schedule.caesium.SchedulerClusteredJobDao.find]: PROPAGATION_REQUIRES_NEW,ISOLATION_DEFAULT (Session #68856829)
[com.atlassian.confluence.impl.schedule.caesium.SchedulerClusteredJobDao.find]: PROPAGATION_REQUIRES_NEW,ISOLATION_DEFAULT (Session #604481428)
[com.atlassian.confluence.impl.schedule.caesium.SchedulerClusteredJobDao.find]: PROPAGATION_REQUIRES_NEW,ISOLATION_DEFAULT (Session #469387056)
[com.atlassian.confluence.impl.schedule.caesium.SchedulerClusteredJobDao.delete]: PROPAGATION_REQUIRES_NEW,ISOLATION_DEFAULT (Session #492750570)
-- referer: https://CONFLUENCE-SERVER/plugins/servlet/embedded-crowd/configure/ldap/?directoryId=1572866&xsrfTokenName=atl_token&xsrfTokenValue=75728ccc58202a1e3735ec07dc78e120605fce8e | url: /plugins/servlet/embedded-crowd/configure/ldap/ | traceId: 0a79e2ca6eb1b9d3 | userName: atlassian-admin
2020-07-29 10:18:26,885 ERROR [http-nio-8090-exec-31] [atlassian.plugin.servlet.ServletModuleContainerServlet] service Request processing failed; nested exception is org.springframework.dao.DataIntegrityViolationException: Hibernate operation: could not execute statement; sql=n/a; ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated
; nested exception is java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated

-- referer: https://CONFLUENCE-SERVER/plugins/servlet/embedded-crowd/configure/ldap/?directoryId=1572866&xsrfTokenName=atl_token&xsrfTokenValue=75728ccc58202a1e3735ec07dc78e120605fce8e | url: /plugins/servlet/embedded-crowd/configure/ldap/ | traceId: 0a79e2ca6eb1b9d3 | userName: atlassian-admin
org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.dao.DataIntegrityViolationException: Hibernate operation: could not execute statement; sql=n/a; ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated
; nested exception is java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (CONFLUENCE.SYS_C009850) violated

...

and many more stacktraces.

Confluence Server version 7.4.1.

Any idea, what this causes?

Greetings

Uwe

[Uwe Mannl · Accepted solution]

I have new information:

The violated unique constraint SYS_C009850 belongs to the database table "cwd_directory_attribute". The constraint is the primary key with the columns "DIRECTORY_ID, ATTRIBUTE_NAME".

So I think Confluence tries to add a new entry in this table for default group membership. But the attribute already exists, so we have a crash.

Perhaps we talk about the attribute "autoAddGroups" ? This is "(null)" ...

Whatever, the attribute should be modified instead of added to the table.

So is it a bug in Confluence?

PS: I don't want to add the default group membership manually to the database, because we only have a production system with this configuration. Our Confluence test system uses Jira crowd instead of LDAP.

[Monique Khairuliana[ServiceRocket]]

We have 3 LDAP user directory entries in Confluence (3 Windows ADs), and no matter for which one I add the group, the error is the same for all.

This sounds like a bug. And you're right attribute should be modified instead of added to the table. I found this bug report:

• Changing User Directory to Read Only with Local Groups shows an error

Does that describe all your symptoms? If not,  I think u need to report this one https://support.atlassian.com/contact/#/

[Uwe Mannl]

Hi Monique,

this is exactly the problem we also encounter.

Unfortunately I didn't found the issue myself :(

I think we can use the mentioned workaround, but it would be better that Confluence could handle this case.

Thanks and greetings! Uwe

[Monique Khairuliana[ServiceRocket]]

My quick research yields this issue:

• Editing "User Directories" configuration is not possible for ORACLE DB user due to DataIntegrityViolationException

Which should be fixed long ago.

Could you try to change something else from this directory and see if you get that error message as well? Can you maybe try to create a new user directory with the same settings as this one, and add the default group membership there and see if it's okay? Also, do you know if the LDAP itself already contains a group with the name "confluence-users"?

[Uwe Mannl]

I can confirm, that there is no group "confluence-users" in LDAP.

We have 3 LDAP user directory entries in Confluence (3 Windows ADs), and no matter for which one I add the group, the error is the same for all.

Also the name of the group doesn't matter. Tried it with test123 and still crash.

Other changes to the user directory can be made without problems. Only this one field leads to crashes.

PS: Don't know whether it is important, but we had to disable "Enable Incremental Synchronisation" long ago, because LDAP synchronization always fell back to full synchronisation. This was the advice at another issue report. After disabling it, no more errors in log.

Not sure if your linked issue is the same as for me. Error messages differs. We also didn't use this version, because we startet with Confluence 6.8 (I think).

I have direct access to the Confluence database. It is possible to find the mentioned constraint? Perhaps this will help us to find, what statement causes the error or something similar.