Setting up Confluence SaaS instance which has external clients

Question

Hi All,

Looking for some advice on the best way of setting up a Confluence instance which allows internal and external, collaboration within an organisation. We are currently setting up a SaaS Confluence instance and have found issues around space permissions.

We cater for our internal organisation users which can be working across a number of projects. We also have external client using our instance. The issue is how we can set up permission whether it is through use of groups or individual access. We would like to prevent e.g. and ASB client from seeing spaces and information stored for ANZ client.

Are there any recommendation around this?

Shannon S · Answer

Anastasia,

You need to provide the users with access to Confluence first before you restrict them to any spaces.

So you would want to first provide them with access to Confluence, but then you need to go into each space that they shouldn't access and make sure that any groups they're included in aren't mentioned there.

A colleague of mine wrote up an article on how to restrict a specific user or group from all spaces but one (or more):

* How to grant access to one space only to a user in Confluence

You can use this example to accomplish what you need. You essentially create a special group for these users, and remove them from the main Confluence users group. I've altered the steps to apply to your situation:

* Go to User Management.

* Click on the Users tab, and click on the user's Full Name.

* Once you're on the user's page, remove the user from the confluence-users group. (You would do this for each of the external users).

* Now click on the Groups tab in the left menu.

* Create a group that will only contain these particular users, you can name it however you like.

* Add the users to this group by clicking on the Add button on the right.

* From the User management go to Application access > View configuration.

* In the Confluence part, add your group and make sure it has the Can sign in checkbox checked.

* Go back to Confluence administration and in the Space Permissions, make sure that the group you created is not listed in the Default Space Permissions.

* On the same page, locate the spaces you wish to grant these users access to and click on Manage Permissions. This will lead you to the space permissions page.

* Click on the Edit Permissions button below the list of groups.

* In the text box, enter the name of the group you created and click Add.

* Set the correct permissions you wish this group to have then click on Save All at the bottom of the page.

I hope that's clear, but do let me know if you have any trouble.

Shannon

Anastasia Gourina · Answer

Hi Shannon,

We are looking at the Cloud Instance.

With the steps given  - is this saying to add a group through global permissions and then assign it to the space in the space restriction level? Rather than the Permissions page?

The idea was that we have one group which all our Employees belong to and another group where external users are added. Both groups have can use access. There are some clients that shouldn't have access to other spaces. How can we stick to this two group model and avoid clients seeing other spaces that they shouldn't belong to?

Shannon S · Answer

Hi Anastasia,

Can you just confirm with me, is the plan to set this up on your Cloud instance, or are you looking to move to Server?

In general, would have to restrict the space permissions for individual users or groups as seen here:

* Restrict External Users/Groups to Certain Confluence Space(s)

There's also a mention of how to do it for Cloud:

For Cloud, you will need to add the group  to Confluence via User Management > Application Access > View Configuration. See Manage group access for more information.

Can you have a look at that and let us know if there's a certain step that you're having trouble with?

Regards,

Shannon