I've got an issue with Atlassian Confluence. Normal users can't log in, but administrators can... Details below!

I manage users using an Apple Open Directory (LDAP). I created two groups: "confluence-administrators" and "confluence-users". I've added team leaders and managers to both groups, and I've added some users to "confluence-users".

Everyone in "confluence-administrators" can log in easily. People in "confluence-users" can't log in at all.

When I look at the user list (in Confluence), and select a user to examine the list of groups he or she belongs to, I can see that the Confluence Administrators are indeed members of the "confluence-administrators" group, but not a single user is a member of the "confluence-users" group. Not event the Confluence Administrators, which are members of both groups!

So I tried to have one of the "confluence-users" log in while watching the Confluence logs. Here's the result:

2012-07-05 14:50:19,698 ERROR [http-8090-11] [core.event.listener.AutoGroupAdderListener] handleEvent Could not auto add user to group: Group <confluence-users> is read-only and cannot be updated
    at com.atlassian.crowd.directory.DbCachingRemoteDirectory.addUserToGroup(DbCachingRemoteDirectory.java:461)
    ...

So it says the group group is read-only... I'm not sure why it is a problem. Well confluence-administrators too is read-only and it doesn't complain.

Some things I don't think are part of the problem:

• I've synchronized Confluence with LDAP many, many times.
• I have verified many times that I didn't make a typo while setting the groups on the LDAP server.
• LDAP synchronization goes well. No errors in the logs (only INFO level log messages).
• The user exists. Errors in the logs are different when a user doesn't exist.

Any help is most welcome!