According to https://confluence.atlassian.com/display/CONF40/Site+Administrators+and+their+Permissions there are three levels of admin access: super user, system administrator, and confluence administrator. The intriguing part of this for us is that only super users have access to all content.
This contradicts my experience. As far as I've been able to tell, people in at least the sytem admin group (and maybe people in the confluence admin group) as set on the View Gobal Permissions page can see all content. That page has no assignable admin permissions other than system admin and confluence admin, and I don't see anything that would assign super user access.
So, is this true? How can I assign super user status or more to the point, how can I remove super user access from system administrators and confluence administators?
Yes, it's true that there are three levels of admin access. The "super user" access is determined by group membership rather than by assigning a permission via the UI. People in the "confluence-administrators" group are the super users.
The full description is here:
The doc page I linked to above says:
The Confluence permission scheme allows the following levels of administrator permissions:
That is three levels of access. I know there is the confluence-administrators group (set by default in the global permissions to system admin permissions), and the confluence-admin group (set by default in the global permissions to confluence admin permissions). Are you saying that there are actually two levels? If so, the doc page I pointed to really should be corrected. I see that the one you pointed me to shows only two levels of access.
FYI, the reason I'm pushing for clarity on this is that it would really help us to have what is described in the list above as "System Administrator" -- full admin access, but not visibiltiy to all the content. I was excited to see this doc, since it solves a problem we're having, but I haven't been able to find a way to actually give someone that ability. I understand that the Confluence administrator setting is meant to not allow full content access, but it also does not allow full admin access.
What has been confusing me is that the Global Permissions page shows (by default) the confluence-administrator group System Administrator permissions. I assumed that is why that group gives any powers. I think that isn't right -- the confluence-administrator group has additional capabilities that cannot be removed from that group. So, people in the confluence-administrator group are "super users", people who are given System Administration access have full admin access but not full access to content, and people given Confluence Administrator access have limited admin access and not full access to content. Sarah, is that correct?
Yes, that's right. There are 3 levels of admin access, and they are as you describe.
The people in the "confluence-administrator" group are "super users" and you cannot remove those rights from them. Even if you remove the "System Administrator" permission from the "confluence-administrator" group, those people will still have full system administrative rights plus the ability to see all the content.
To make sure, I just tested the following:
"Superman" still had full administrative powers, due to his membership of the "confluence-administrator" group.
Thanks, Sarah. You've clarified things for me.
FWIW, it would have been helpful to have this explicitly laid out in the documentation, like:
There are three levels of admin access:
1) Super Users. These have access to all admin functions and also to all content. A super user is a member of the confluence-administrator group.
2) System Administrator. These have access to all admin functions. A system administrator is assigned this access on the Global permissions page, or is a member of a group given System Administration access on the Global Permissions page.
3) Confluence Administrator. These have access to some admin functions. A confluence administrator is assigned this access on the Global permissions page, or is a member of a group given Confluence Administrator access n that page. (Note that this is quite different from membership in the confluence-administrator group.)
Do you use templates with Confluence? Take part in a remote 1-hr workshop. You'll receive USD $100 for your time! We're looking for people to participate in a remote 1-hr workshop...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs