Page restrictions versus Permissions

Question

Problem/situation

A user, who happens to also be a site-admin next to me, has created a page with page restrictions. Another user asked me to give her access and even though I appear to have the right permissions for the space as well as I am (member of) site-admin, I cannot give her access.

On the other hand, when following the procedure to remove restrictions from the Restricted page tab in the Space admin, it even gets worse. When clicking on the padlock of a user that has already been given access by another person who has access rights to the restricted page - the access get removed. So instead of giving people access it gets removed and I can't add/remove users myself either nor can I access the page.

Has anyone experienced this similar problem? What am I doing wrong, if so? The question is in particular relevant now because we are going to deploy a Space admin/Site-admin structure soon.

I have also filed a ticket because it is for behaviour that is not consistent with the specs for as much as they have been described by Atlassian here:

https://confluence.atlassian.com/confcloud/permissions-and-restrictions-724765432.html

In addition: the usergroup system-administrators exist on the Global Permissions tab yet cannot be added to my user. Would the system-administrator have different/more rights than the administrators or site-administrators and have the rights to give people access to a page?

Answer to the above paragraph: no, this permission is only granted to Atlassian staff who administer your Confluence instance.

Thomas Schlegel · Answer

You're right, this is a complex subject. There are good arguments for both opinions.

But I still think, the "owner" of a page has to add all restrictions and anyone who wants to see his page, has to ask him, not any other admin.

Breaking all the locks is a security issue also. But that is just meant for pages that are not accessible any more without breaking the lock by an admin.

Stéphane Veraart (Devoteam) · Answer

I agree with your remark as social (or 'behind-the-keyboard') problem in that sense.

But this is a subject (restrictions, rights, groups and users) that is very complex in any application because the cross-sections of sets of users can create complexities that become too complex to manage. Usually, simple is better and 99% effective.

However, in my opinion site-admin with all rights to add/delete Restrictions should be able to add/remove users from the Restricted page groups - both on user level (add/remove users) and page levels (add/remove restrictions). In that sense one would expect to be able to do that when one has these rights or do you disagree?

Thomas Schlegel · Answer

Thank you for the screenshots. I think, it is a social problem, not a technical one. A page restriction should prohibit any user from watching a page instead the ones, who have the permission.

Any user means: also admin users.

So, if your co-admin restricts a page, she / he thinks noone except these named persons should see the page.

In the emergency case, you as space administrator are able to break the lock. But since this is just an emergency solution, you don't have the possibility to add more users to a page restricted by anyone else.