Security and Group Users - Issue

Hi @shreyas_tm,

Thank you so much for sharing the information.

Thank you for reporting the issue regarding users being automatically removed from groups on the PN instance in your AEM Forms JEE environment. We have analyzed the behavior, and here are our initial findings and next steps:

Observations

• The issue is specific to the PN instance. Groups are created successfully, but the user memberships are getting removed automatically after some time.

• On the PR instance, group memberships remain intact and function as expected.

• The same behavior occurs for newly created groups, indicating this is not limited to older configurations.

Possible Causes

Based on how User Management works in AEM Forms JEE:

1. Directory/LDAP Synchronization – If directory synchronization is enabled, the PN instance may be running a scheduled sync job that overwrites or removes manual group memberships. There is a configuration setting in User Management to “Preserve local group membership”; if this is disabled, manual changes may be lost.

2. Cluster Behavior – In a clustered JEE deployment, user/group data is stored in the common User Management database. If PN is not fully synchronized with the shared DB or has an inconsistent configuration, it can refresh its local cache and appear to “drop” memberships.

3. Configuration Differences – There may be configuration mismatches between PR and PN in adminui > Settings > User Management > Configuration > Directory Management, which can lead to different sync or cleanup policies.

Recommended Next Steps

1. Verify Directory Sync Configuration

   • Please confirm whether LDAP/Directory sync is enabled on PN.

   • In AdminUI > Settings > User Management > Configuration > Directory Management, check if the option Preserve local group membership is enabled.

2. Review Logs on PN

   • Check um.log and server.log on PN around the time the users are removed for entries related to Directory Sync or membership removal.

3. Check Database Consistency

   • Since User Management is backed by the database, we should verify that the group membership entries exist in the EDCPRINCIPALENTITY and related UM tables after adding users on PR. This will help confirm if memberships are actually being removed from the database or only from PN’s local view.

4. Ensure Consistent Configuration Across PR and PN

   • Export the User Management configuration XML from AdminUI on both PR and PN and compare them. Both nodes must share identical configurations to ensure consistent behavior.

Interim Workaround

• Until this is resolved, please make all group membership changes from the PR instance. This ensures that changes are committed correctly to the shared UM database.

• If LDAP sync is not required on PN, consider disabling any scheduled Directory Sync jobs there to prevent overwriting of local memberships.

We recommend performing the above checks, and once we have the logs and configuration details, we can provide you with more specific guidance.

Thanks

Pranay