We have Confluence (6.2.4), Jira (7.4.0), Bitbucket (5.2.0) and Bamboo (6.0.3). All are using Jira as base user directory for all users and groups.
In Confluence we can allow user to have admin rights but he can't edit group memberships.
Same in Bitbucket, a bitbucket-admin level user can't edit group memberships.
But in Bamboo user with bamboo-admin level permissions can edit group memberships inside Bamboo. He can insert himself to all groups found from Jira. And when all user directories have been syncronized, he has gained full access to everything everywhere.
Why is Bamboo not using read-only user directory, or is there a way to block this behaviour in Bamboo, or has there been update to address this somewhere between 6.0.3 to 6.2.3?
