nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Confluence logged in users cannot access while anonymous can

Roberto Rocha R1

Hello,

In our Confluence instance we have configured Group AAA to have access to Confluence (Global Permission) to create some pages. And also, Anonymous Access to Confluence is Enabled.

The problem is: users from JIRA that aren´t in Group AAA can´t access Confluence when logged. Confluence shows an 'Restricted access page' instead of treat them as Anonymous. However, they can logoff and access Confluence and all pages.

When Anonymous Access is enabled, I think Confluence should handle users without permission as anonymous because it is very weird they can access when not logged and cannot access when logged... Please, what do you think? Our configuration is wrong?

Accepted answers

All comments

Rob Woodgate

Hi Roberto,

JIRA and Confluence share a login system. If your users are logged into JIRA then they are also logged into Confluence, and therefore they are not anonymous users.

You said:

"Confluence should handle users without permission as anonymous"

No, it absolutely should not. By default every space and page is open to everyone; you have to take permissions away from people to tell Confluence that they shouldn't have access. If Confluence treated users without permissions as anonymous then there would be no way to stop people accessing anything, except to also stop anonymous access.

To solve your problem, create a group for all of your JIRA users who aren't in Group AAA, and give that new group View Only permissions.

Roberto Rocha R1

Hello Rob,

Thanks for your quick response!

I understood your explanation and I only want to know Atlassian's opinion about this functionality / behavior.

These are my considerations:

By default every space and page is open to everyone; you have to take permissions away from people to tell Confluence that they shouldn't have access.

I didn´t take away any permission. In fact, if you only enable Anonymous Access and don´t give permission to your users, anonymous users will be able to access Confluence but not logged users. IMHO, this is not an intuitive behavior and doesn't make sense. You can access after logoff?! This make sense for you?

create a group [...] and give that new group View Only permissions.

Then, you are saying my configuration is wrong or that, if I want give access to all, I need to set view only permissions to all users, even when Confluence is configured with Anonymous Access = Enabled. This is not practical.

If Confluence is configured with anonymous access, then everyone can read. Why do I need to configure for each new group and user?

Nic Brough -Adaptavist-

I mostly agree with Roberto here. Whilst the behaviour is technically understandable, it is counter-intuitive and not really that sensible.

The reason it is understandable for me is:

Let's say that you have a space that has anonymous access and a single user who is the space admin.
Another user has not logged in, so they are anonymous.
You grant anonymous access. So the user can see the space.
The user logs in. You now know who they are.
The bit that is counter intuitive, but technically right: once a user is known, they don't now count as anonymous, so they can't see this space, because the security says "anonymous + space admin. And only those two"

Not only is this counter-intuitive, it doesn't actually have any use. I can't see a situation where you'd let an anonymous user see a space but deny it to logged-in users. (I can see the point of informational text being hidden, but not much else - "you're logged in, so I am not going to nag you to create an account")

Rob Woodgate

Hi both,

I really don't see this as counter-intuitive, it makes perfect sense to me. A user is logged in, or they aren't. If they aren't, then they are an anonymous user, and anonymous users have specific permissions that can be (and usually are) different than the permissions for a logged in user.

I agree that Confluence could set base permissions for logged in users to be the same as anonymous users - e.g. if anonymous users can see a page then logged in users can as well - but this would have to be an option that could be turned on. Just because we can't think of a situation where an anonymous user is allowed to view or edit a page but a logged in user can't doesn't mean such a situation doesn't exist.

I'd also suggest that the granular control over permissions is on of Confluence's strengths, rather than a weakness.

Roberto - with regard to your situation, yes, I'm saying your configuration is wrong. I have sympathy for your circumstances and you make a fair point, but this is the way that Confluence works. If your JIRA members are logged in, they have to be a member of group that has access to Confluence, otherwise they won't be able to access Confluence.

I suggested a view-only group because I assumed you wanted the same permissions for them as anonymous users, and anonymous users normally aren't given permissions to edit. But that's up to you. By default there's a confluence-users group with standard view/edit permissions for every space and page, just add all of your JIRA users to that and you're good to go.

Balázs Szakál [META-INF]

I can suggest you to trial the Ultimate Permission Manager add-on, which can help you to discover that who can view/edit which spaces/pages and why Might be very useful, especially if you have a complex permission system on a huge instance!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

permission

confluence-administration

anonymous

access