Audit Confluence pages and security

[Erik Ekengren]

Our company are trying to increase the security and the data quality on all the systems we are using. In order to accomplish this in Confluence one feature that we need is to be able to have different levels of security on the pages. For example in an Confluence space we could have several pages that have level 1 security and other pages that have level 2 security. Each of these pages should also have an owner.

What we are looking for is basically to be able to audit ALL pages in our Confluence environment and sort them by level and owner and see if they have been updated and have correct data. Also if we would say change a page from level 2 to level 1 then it should automatically change the permissions on the page. The design of the pages should also be different, could be as simple as another picture on the page, however due to demands of simplicity it must be done automatically when changing a level.

Does anyone knows if this is possible? Plugins would also be helpful if there are any that meets our needs.

[JP _AC Bielefeld Leader_ · Accepted solution]

Hi,

I might just give some thoughts & ideas on your question(s)...

Lets define "security" first: This should be handled on the space level, if possible. You define, which user / groups have access to a space & if they can create/change/delete content.

You can set restrictions on pages inside a page hiding them from users / groups (with access to the space). These view restrictions can be inherited from parent pages.

You can set edit restrictions on a page, disabling users / groups from modifying the page. The page can still be copied to another space (create permissions granted).

Let's move on with some auditing / versioning of a page:

Confluence keeps an automatic history of changes done to a page and even attachments of a page, BUT with collaborative editing enabled & multiple editors working on a page draft, you cannot find out, who made a specific change to a specific part on a page.

Some words on reporting / ownership and sorting:

What you can do is, create a page property macro on each page (which can be hidden in view mode). This macro contains a key-value table that allow defining page attributes later used  as columns in a page property report. One row of that table could be a property "Owner". You can also have rows containing "Created", "Last modified",.... Lots of these attributes can be set automatically by using macros.

To make the page property reports work, you also need a label added to a page. One idea would be to set your security level "level1" and "level2" as labels. This allows for separate reports on each page security level.

Now comes the more interesting part: Automation

You might want to check out some addons: Adaptavist's ScriptRunner allows for multiple manipulation of pages triggered by buttons, actions... Another option could be Comala Documents with auditing, page & space workflows, reporting etc. We use both with different use cases.

Hope I could give you some ideas.

Best

JP

[Erik Ekengren]

Hi JP and thank you for the answers!

Yes I agree that the optimal solution would be to handle the permissions levels at Space level and have one or several owners of that Space that handles the permissions. However our security department would like that every page in all spaces has an owner and also based on the security level on that page only some people/groups should have access to it. This is what makes this a bit difficult for me as an Confluence Admin since I am not sure this is possible. I would then need to be able to find a way to get the data of all pages and who is owner of them, for example if a user would quit the company I would need to find all pages that he/she owns and give that list to someone.

I really like the idea of the Page Properties Macro. I didn´t knew about that and it seems like it surely have potential!

I was thinking of doing something simple, like create a user macro that has different statuses like level 1, level 2 etc. and that it would be visible on each page. Do you know if it would be possible from a user macro to update the Label on a page, for example if I change from level 1 to level 2 could my user macro also remove Label level1 and add level2? 

BR/

Erik