Summary

After restoring a backup from Jira Cloud to Jira Server when trying to edit existing users, the following error is shown "Cannot edit group memberships, as external user management is enabled, please contact your Jira administrators."

Environment

Any Jira version.

Diagnosis

1. This issue resembles the problem described in the knowledge base article Unable to create or edit users and groups. In this case, external user management is already disabled, and no external directory exists.
2. In the database, check the permissions available to the internal directory. 
   

   1. Run the query this query against the database.

      SELECT * FROM cwd_directory_operation WHERE directory_id = 1;

   2. Under normal circumstances, the following 12 rows would appear. However, in this case, nothing is returned.

      

3. The following error shows up in the application logs.

   2022-09-19 10:31:59,121+0000 http-nio-8080-exec-21 ERROR anonymous 631x686x1 xsessionidx xipaddressx /login.jsp [c.a.j.security.login.LoginStoreImpl] com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user attributes 'sysadmin' in directory 'Jira Internal Directory'.
   com.atlassian.crowd.exception.OperationNotPermittedException: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user attributes 'sysadmin' in directory 'Jira Internal Directory'.
   	[...]
   Caused by: com.atlassian.crowd.exception.ApplicationPermissionException: Not allowed to update user attributes 'sysadmin' in directory 'Jira Internal Directory'.

Cause

Due to  JRACLOUD-80978 - Getting issue details... STATUS , the Jira Cloud export is missing necessary directory operation permissions.

Solution

1. Navigate to ⚙️ (gear icon) > User management > User directories.
2. Click the edit button next to Jira Internal Directory.
3. Without making any changes, click Save and test. This will trigger a backend operation on the database, recreating all the operations in the table.
4. If you return to your DB and rerun the SQL command, you should see the operation values listed and be able to edit user directories and manage users as expected.