Users are not unassigned from Liferay groups if the LDAP user group is empty

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.2.X, 7.3.X, Master
• Fix Version/s: 7.2.X, 7.3.X, 7.4.3.23 CE GA23, Master
• Component/s: Application Security > LDAP
• Labels:
  • NAT
  • ee-ts
  • liferay-fixpack-dxp-5-7310
  • liferay-update-dxp-5-7310
• Branch Version/s:
  7.3.x, 7.2.x
• Backported to Branch:
  Committed
• Story Points: 8
• Fix Priority: 3
• Git Pull Request: https://github.com/liferay-appsec/liferay-portal/pull/632

Summary:
If all users belonging to a user group (in the LDAP server) are deleted from the LDAP user group (the user group is then empty), these users are not unassigned from the Liferay user group.

On the other hand, if the LDAP user group has at least one user, the users removed from the LDAP user group are also unassigned from Liferay user group.

The behavior should be the same even if the LDAP user group is empty or not.

Steps to reproduce:
If the LDAP user group is empty,  "usr1" and "usr2" are unassigned from Liferay user group "grp1" after LDAP import.

1. Access Control Panel > Instance settings > LDAP and configure:
   General: Enabled = true.
   Import: Enable import = true
   Import method = Group
2. Add two LDAP user groups in the LDAP server: "grp1" and "grp2".
3. Add three LDAP users in the LDAP server: "usr1", "usr2", "usr3".
4. Add "usr1" and "usr2" to "grp1".
5. Add "usr2" and "usr3" to "grp2".
6. Execute LDAPImport from Liferay.
7. Remove "usr1" and "usr2" from "grp1" (do not remove "grp1") in LDAP server. "grp1" must be empty.
8. Execute LDAPImport from Liferay.

Result expected: "usr1" and "usr2" are unassigned from Liferay user group "grp1".
Actual result: "usr1" and "usr2" are still assigned to Liferay user group "grp1".

Note:
If the LDAP users group has at least one user, "usr1" and "usr2" are unassigned from Liferay user group "grp1" and it works as expected:

1. Access Control Panel > Instance settings > LDAP and configure:
General: Enabled = true.
Import: Enable import = true
Import method = Group
2. Add two LDAP user groups in the LDAP server: "grp1" and "grp2".
3. Add three LDAP users in the LDAP server: "usr1", "usr2", "usr3".
4. Add "usr1", "usr2" and "usr3" to "grp1".
5. Add "usr2" and "usr3" to "grp2".
6. Execute LDAPImport from Liferay (attached groovy script).
7. Remove "usr1" and "usr2" from "grp1" in LDAP server. Don't remove user "usr3".
8. Execute LDAPImport from Liferay (attached groovy script).