How to restrict access to personal spaces when a user is in confluence-users (Confluence 5.6.4)

Question

We need to allow some external security auditors access to a single space in Confluence in order to allow them and the internal users being audited to update the audit documents.  We created the space, created the group for the auditors, and then created the auditor accounts (added them to confluence-users and their special auditor group).  They can see the audit space, but they can also views everyone's personal space (including any files people have in their personal space).  I tried removing access to a personal space by removing View permission for both the auditors groups and their userids.  However, because they belong to confluence-users, they are still allowed access.

Is there any way to restrict their access to only their space?  Is there any way to lock down anonymous access to only the auditors?  I've searched the documentation, knowledge base, and this community and have not found a definitive answer.

Thanks for the help!

Teri

Olle Friman · Answer

To allow a user to just see one Space and nothing else I would suggest to separate the confluence-users group from any other access except for being able to login to Confluence . So only use it in the Global Permissions setting. Then you can add another group for the basic access for regular users, which you do not include for the security auditors. These users you just allow to see specific spaces.

My recommendation is to do the same for jira-users group in Jira. Never use it for any other permissions than for logging in to Jira.

There is one challenge to make sure no other user are using these groups for permissions setting. Our way around that is the have a recurring issue for reviewing how it looks for a user with just jira-users and confluence-users set. Any ideas how this could be automated in some way would be appreciated.

Thanks

Olle

Teri Simonds · Answer

Brant,

That's exactly what I need.  I have one final question.  Can you allow access to more than one group?

Thank you so very much for your help!

Regards,
Teri

Brant Schroeder · Answer

Teri,

I believe this is what you are looking for: https://confluence.atlassian.com/confkb/how-to-restrict-users-from-accessing-people-directory-or-search-users-from-quick-search-688883545.html