nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Why are some AD users disabled?

Frank25

For no obvious reason a subset of our AD-users are marked "disabled" in Confluence.
Their group memberships are listed correctly and everything is fine except the fact that they are marked "disabled" and cannot log in.
To be exact: they can log in (password seems to be verified successfully against AD) but they have access to no content whatsoever.

Any ideas what might be the reason and how i can get to the bottom of that issue?

Accepted answers

Frank25

I found the reason for the strange behavior: the DN that came back from AD is not necesarily unambiguous and at the same time in confluences' AD adapter "naive matching" was enabled - which requires unique DNs.

So i now turned off naive matching and got to know my AD internals a little better wink

Wiki Hard!

All comments

Simon Kegel //SEIBERT/MEDIA

Hey Frank,

is there some more info about these users? Do they share some permission the enabled users haven't f.e.?
I could imagine your user limit is just reached.

Greets
Simon

Frank25

Hey Simon,

the disabled users do share the same groups and therefore also the same permissions as the not-disabled users - they have some additional groups that the other users don't have - but they are not configured in any way that should interfere/influence confluence.

User limit is not reached - i checked that explicitly because it was also one of my firtst thoughts wink License details tells me we have now 72 of 100 users - so that is not the source either.

Only difference between the users i could imagine is that they're in a different sub-folder (~= OU) within AD than the rest of the users.

\ domain.local
.|
.\ MyBusiness
..|
..\ Users
...\- OU1 (working users)
...|
...\- OU2 (disabled users)

However I have no deeper knowledge of how this would affect their ability to log in..?

Frank25

So i now turned off naive matching and got to know my AD internals a little better wink

Wiki Hard!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

confluence-administration