bug5171: avoid concurrent modification exception when deleting user

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -1203,7 +1203,6 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
             // remove all permissions the user has
             accessControlStore.removeAllOwnershipsFor(userToDelete);
             store.removeAllQualifiedRolesForUser(userToDelete);
-
             final String defaultTenantNameForUsername = getDefaultTenantNameForUsername(username);
             final UserGroup defaultTenantUserGroup = getUserGroupByName(defaultTenantNameForUsername);
             if (defaultTenantUserGroup != null) {
@@ -1218,7 +1217,10 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
                 }
             }
             // also remove from all usergroups
-            for (UserGroup userGroup : userToDelete.getUserGroups()) {
+            final Iterable<UserGroup> userGroups = userToDelete.getUserGroups();
+            final Collection<UserGroup> userGroupsToLoopOver = new ArrayList<>();
+            Util.addAll(userGroups, userGroupsToLoopOver); // avoid concurrent modification exception
+            for (UserGroup userGroup : userGroupsToLoopOver) {
                 if (userGroup != defaultTenantUserGroup) { // the defaultTenantUserGroup has already been deleted above
                     internalRemoveUserFromUserGroup(userGroup.getId(), userToDelete.getName());
                 }