nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What is the possibility of user specific data loss if I modify the external user directory configs?

Akul Bhatnagar

What are the possibilities of user-specific data loss if I modify the existing external user directory (Microsoft AD) configuration?

I want to modify the configuration of the existing user directory coz the LDAP administrator is going to move the DL (distribution list) from one OU to another OU at some different location. So, I would just be updating the user / group filters so that confluence picks up the correct DL.

Could someone suggest the areas of concerns?

Abbreviations,

OU is Organizational Unit
DL is Distribution List
AD is Active Directory

Accepted answers

All comments

Davin Studer

There should not be an issue. So long as your membership doesn't change you should be fine. Even if your membership changed you wouldn't really lose any data. You may see pages where the creator or updater is set to something like Unknown User (jsmith), but the pages wont dissapear. And if the user got added back in then it would just link right back up.

Akul Bhatnagar

Thank you for the reply, David!!!

So could you please explain the "your membership doesn't change" thing more? Unfortunately, I am not very familiar with AD terminologies.

Also, I decided to Disable the Microsoft Active directory under User Directories from confluence administration for the time when AD administrator moves the security group to another OU.

My only intention behind is to stop sync between confluence and AD when configured "security group" moves to another OU and then Enable it again so that confluence can sync the groups and users again w/o any impact. Is my understanding correct?

I am being too cautious coz we recently did this with HipChat and ran into issues (everyone lost their room membership and ownership). We need to know if Confluence will have any similar issues.

Here is a very high-level plan of what I will do,

1. Update the staging confluence server to use ConfTestGroup (IT provided security group for testing sake. This is exactly same as the existing security group in all the terms like location, user, etc.)
2. Do some testing to confirm there aren’t any issues.
3. Stop confluence from syncing security groups from AD
4. Have IT move ConfTestGroup to the new OU
5. Update staging confluence settings to use the new OU
6. Start confluence syncing so that it syncs security groups from new OU
7. Run test cases to confirm nothing broke (Let me know if you can suggest some important cases to be checked)

Akul Bhatnagar

Thanks, David!!!

Could you please explain "membership does not change" thing a little more?

My very high-level plan to implement the whole change is,
1. Update the staging confluence server to use ConfTestGroup (IT provided security group for testing sake. This is exactly same as the existing security group in all the terms like location, user, etc.)
2. Do some testing to confirm there aren’t any issues.
3. Stop confluence from syncing security groups from AD
4. Have IT move ConfTestGroup to the new OU
5. Update staging confluence to use the new OU
6. Start confluence syncing so that it syncs security groups from new OU
7. Run test cases to confirm nothing broke (Let me know if you can suggest some important cases to be checked)

Please let me know how you think it's gonna be.

Davin Studer

By membership I am referring to the members of the Active Directory groups. If you change the location of the groups, but do not change the group names or the people in the groups you should not have any issues ... assuming you setup your Active Directory user directory to point to the new location of the groups.

As for disabling the Active Directory user directory I don't think that is what you realy want to do? That will lock out everyone from your Confluence system that was added via Active Directory.