Hello,
We have been using local accounts for our instance of confluence but recently decided we wanted to utilize LDAP (Active Directory) integration so we have fewer user accounts to remember. I was able to go through and configure confluence to connect to our directory server and am able to pull users and group without issue. What I am having problems with is filtering the users that get automatically pulled into confluence as we do not want all users in our AD pulled into this. I did create group object filer rules that are working so that only certain groups are being presented but I am struggling with how to properly filter the number of users. What I would like to be able to do is only pull users that are members of specific AD groups (Using wildcards is an option since we use a consistent naming format). The primary reason why I want to filter the users that get pulled into this is because we don't want to have to buy a license for all user accounts in our domain as they wouldn't use the product. I have referenced this article for some of my work but I am still stumped so any help that could be provided would be greatly appreciated.
https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html
Thank you
You can use memberOf as part of your user object filter to restrict the scope. Take a look at https://confluence.atlassian.com/crowd/restricting-ldap-scope-for-user-and-group-search-169118612.html. It is for Crowd, but you can use the filter the same way in Confluence.
Note that it is not the number of users that you import from LDAP that control the number of licenses you need, it is the number of users that have permission to log on to Confluence.
Instead, you should use
Under Global Permissions, ensure that only 'confluence-users' is allocated to Can Use Confluence permission.
Now, users will only be licensed when they log in initially. If you need to control who can log in, then you can reinvestigate Filters.
Does a license get counted if they login but don't have permissions to anything?
Yes. If they can log in, they use a licence.
To avoid that, just check the "can log in" group(s). If they're not in there, they don't count towards your licence and they can't log in.
Found that my user filters that I had tried using didn't work because it didn't support nested groups. If I added users as direct members of the targeted groups the filter worked as expected. If nested groups is not an option for this filter then I'll just have to add the users directly and call it a day. But if there is an option for nested groups that would be nice.
It looks like you're new here. Sign in or register to get started.
