Anonymous user can create/delete pages

[Michael Clinton]

Hello - I am using a Confluence space as a knowledge base for users of my app. We are just about ready to launch this and I now notice that an anonymous user can create and delete pages.

But I have these permissions turned off. See below screenshot.

Am I missing something?

[Phil Jackson · Accepted solution]

The password reset feature should work, as long as you have the AD setup to read/write changes back to AD. If you don't want that to happen, you can change it to read only and groups, and turn the external management on. Also, I would check to see that the syncs are going through successfully.

[Michael Finnegan]

Thank you for your reply, Mr. Jackson.  We do have the user directories set up as: 1) LDAP Server - Microsoft Active Directory (read only with local groups); and 2) Confluence Internal Directory (Internal) in that order.  Synchronizing does appear to be happening, and I'm able to manually synchronize the LDAP connection.  Would you mind elaborating on turning external management on?  I'm not familiar with that option.  I should add that our network team is unlikely to allow read/write back to AD from Confluence.  Thanks again.

[Phil Jackson]

Not sure what version of confluence you are on, but it should be the same steps.

1. Go to general configuration
2. Security Configuration
3. Click edit and check the External user management box.

That will remove the forgot password link from the confluence login page

[Michael Finnegan]

Many thanks for your replies and recommendations.