I have a scenario where custom groups have been created in confluence. Space admins generally add the users who are entitled to see the contents of space to the group.
Now there have been cases where the space admin do not do due diligence and instead of creating the custom group and adding the users to the group, they directly attach the confluence-users group to the space. Now confluence-users group have all the users as the members. This poses a security risk where some of the restricted contents gets exposed to the unintended users.
I am trying to explore a solution where we can disable the right to add the confluence-users group or hide the confluence-users group from getting displayed in list of groups to the space by space admin by default. Confluence-group can be added only by confluence tool administrator if the space admin follows a particular approval mechanism of the organization.
No. You need to train your admins to be more careful.
The ability to add any group to a Space is critical, because most users need that (and you'd end up with lots of people saying "I can't find the group I want to add"), so Confluence has no functions for restricting the choice of groups.
What you could do is remove the confluence-users group completely, and add common groups into the "can use confluence" permission separately.
Two vulnerabilities have been published for Confluence Server and Data Center recently: March 20, 2019 CVE-2019-3395 / CVE-2019-3396 April 17, 2019 CVE-2019-3398 The goal of this article is...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs