Why is users removed automatically from user groups?

[Leif Nerheim]

I have created a user group in Confluence servers. Have added some 50-ish users to the group. But users are automatically removed from the group - by the user "Anonymous".

Seems like it's happening random and automatically?

[Nic Brough -Adaptavist- · Accepted solution]

How exactly do you know that the group is being modified by "anonymous"?

What user directory system are you using?

[Leif Nerheim]

Hi Nic!

I see it in the Audit log. I was wondering why users I added one day was gone the next:-)

[Nic Brough -Adaptavist-]

Anonymous users cannot be given admin rights, so it was not a human doing this.

Most likely explanation is that the groups have been modified in your external directory system.

[Leif Nerheim]

We are using the app "SAML Single Sign On for Confluence". No problems with access to Confluence, but when adding to a group in Confluence, som users seems to be automatically removed by "Anonymus". I've created that group in order to restrict a page. 
The problem occurs on pretty much the same few (5'ish) users. I'm adding - and Anonymus is removing?

[Nic Brough -Adaptavist-]

Ok, I think we are both drifting around the problem and looking at "maybe" before we've focussed on the core of it.  I would like to go back to the basics and establish that I understand enough about your setup to be sure I'm looking at the right part.

To do that, can you tell us:

1.  What user directory, or directories, you are using.  Go to Admin -> User directories and show us what the list of directories is (feel free to obscure server/domain names etc, we are only interested in the technical details - the type, last sync, filters, order and so-on)

2. Where you are getting the reports of "Anonymous removed User X from groupY" from?

[Leif Nerheim]

1) Confluence Internal Directory

Katalognavn                                          Type       Rekkefølge           Operasjoner

Confluence Internal Directory              Intern

2) Audit logs

21. des. 2021, 09:01:00 CET  Anonymous  Users and groups   User removed from group  lederne   “userid”

[Nic Brough -Adaptavist-]

Ok, great, that really narrows it down.  I was suspecting you might have an external directory and changes there would be recorded as "anonymous" in the audit logs, but that's not the case here.

In the audit logs, anonymous means "it was not done by a human logging in and clicking things" or even "it was not a human running a REST call to do it", it was a system call.

You have a service, or script, or app, that is changing the user groups for some reason.  Start with a quick look at "manage apps" - are there any in there that might be doing user management?  Then look at the lists of services and listeners you have running.

[Leif Nerheim]

Hi!

Thanks for your guiding and tips to resolve the problem.

Haven't found any apps that are doing user mngmnt. 

Off for christmas holiday now - looking into it again in 2022:-)

[Pramodh M · Accepted solution]

Hi @Leif Nerheim 

Your site may have anonymous user access, please check the global permissions and default space permissions to troubleshoot the access.

You may also audit the cause of the issue in logs and by tracking the user sessions.

Thanks,
Pramodh

[Leif Nerheim]

Hi Pramodh,

Yes, I see in the global permissions that "Anonym" are allowed tu use Confluence - with anonym access.

But I thought this user also was involved in creating new users based on our SAML/SSO connection?

What is the consequnse of turning Anonym off? 

[Nic Brough -Adaptavist-]

It means people who have not logged in will not be able to see any pages.

[Leif Nerheim]

I have changed the "Anonym acces" setting to "can not use Confluence" on the Global acces page - but the problem continues - Anonym still removes users from the group