Are there really three levels of administration access?

[Jonathan Simonoff]

According to https://confluence.atlassian.com/display/CONF40/Site+Administrators+and+their+Permissions there are three levels of admin access: super user, system administrator, and confluence administrator. The intriguing part of this for us is that only super users have access to all content.

This contradicts my experience. As far as I've been able to tell, people in at least the sytem admin group (and maybe people in the confluence admin group) as set on the View Gobal Permissions page can see all content. That page has no assignable admin permissions other than system admin and confluence admin, and I don't see anything that would assign super user access.

So, is this true? How can I assign super user status or more to the point, how can I remove super user access from system administrators and confluence administators?

[SarahA · Accepted solution]

Hallo Jonathan

Yes, it's true that there are three levels of admin access. The "super user" access is determined by group membership rather than by assigning a permission via the UI. People in the "confluence-administrators" group are the super users.

The full description is here:

https://confluence.atlassian.com/display/CONF40/Global+Permissions+Overview#GlobalPermissionsOverview-ComparingtheAdministratorPermissionswiththeconfluence-administratorsGroup

Cheers, Sarah

[Jonathan Simonoff]

Hi, Sarah

The doc page I linked to above says:

The Confluence permission scheme allows the following levels of administrator permissions:

• Super-User– full administrative access to Confluence, plus visibility to all the content.
• System Administrator– full administrative access to Confluence.
• Confluence Administrator– access to most of the Confluence administrative functions.

That is three levels of access. I know there is the confluence-administrators group (set by default in the global permissions to system admin permissions), and the confluence-admin group (set by default in the global permissions to confluence admin permissions). Are you saying that there are actually two levels? If so, the doc page I pointed to really should be corrected. I see that the one you pointed me to shows only two levels of access.

FYI, the reason I'm pushing for clarity on this is that it would really help us to have what is described in the list above as "System Administrator" -- full admin access, but not visibiltiy to all the content. I was excited to see this doc, since it solves a problem we're having, but I haven't been able to find a way to actually give someone that ability. I understand that the Confluence administrator setting is meant to not allow full content access, but it also does not allow full admin access.

[Jonathan Simonoff]

What has been confusing me is that the Global Permissions page shows (by default) the confluence-administrator group System Administrator permissions. I assumed that is why that group gives any powers. I think that isn't right -- the confluence-administrator group has additional capabilities that cannot be removed from that group. So, people in the confluence-administrator group are "super users", people who are given System Administration access have full admin access but not full access to content, and people given Confluence Administrator access have limited admin access and not full access to content. Sarah, is that correct?

[SarahA]

Hallo Jonathan

Yes, that's right. There are 3 levels of admin access, and they are as you describe.

The people in the "confluence-administrator" group are "super users" and you cannot remove those rights from them. Even if you remove the "System Administrator" permission from the "confluence-administrator" group, those people will still have full system administrative rights plus the ability to see all the content.

To make sure, I just tested the following:

• Created a user called "superman" who is a member of the "confluence-administrator" group but does not have "System Administrator" permission.
• Removed the "System Administrator" permission from the "confluence-administrator" group. (I made sure my default admin user had all permissions, before removing the permissions from the group, of course!)

"Superman" still had full administrative powers, due to his membership of the "confluence-administrator" group.

Cheers, Sarah

[Jonathan Simonoff]

Thanks, Sarah. You've clarified things for me.

FWIW, it would have been helpful to have this explicitly laid out in the documentation, like:

There are three levels of admin access:

1) Super Users. These have access to all admin functions and also to all content. A super user is a member of the confluence-administrator group.

2) System Administrator. These have access to all admin functions. A system administrator is assigned this access on the Global permissions page, or is a member of a group given System Administration access on the Global Permissions page.

3) Confluence Administrator. These have access to some admin functions. A confluence administrator is assigned this access on the Global permissions page, or is a member of a group given Confluence Administrator access n that page. (Note that this is quite different from membership in the confluence-administrator group.)