Change the built in Admin "super-user" account

We have recently changed our login directory from one domain to another and want to change the Admin group with the "Special permissions" and admin access everywhere to a group in our new login domain but I can't figure out how this is done.

 

Thanks

3 answers

0 votes
Bill Bailey Community Champion Jun 14, 2017

I am assuming you are referring to LDAP? As long as whatever group your admins are in, are also members of confluence-admins, you are good to go.

Thanks for the reply. confluence-admins is on a different LDAP domain, the one we're trying to decommission. 

0 votes
Thomas Schlegel Community Champion Jun 15, 2017

Hi Miles,

you configure the basic Jira-admin permissions here:

http://<your-jira-url>/secure/admin/GlobalPermissions!default.jspa

There you can add the admin permissions to new groups. But be careful to not lose your own admin permission by doing this!

0 votes

If you want to use LDAP groups to set permissions that works fine but please include a group called confluence-administrators in the LDAP directory you migrate to. If you cannot get that group created in LDAP, consider making your LDAP user directory "read-only with local groups" so you can add your admins to the confluence-adminstrators group in the Confluence Internal directory. This article explains in more detail: Confluence Admin Permission Levels Explained

"The confluence-administrators group defines a set of "super users" who can access the Administration Console and perform site-wide administration. Members of this group can also see the content of all pages and spaces in the Confluence instance, regardless of space permissions."

 

So I can't specify a different group to give the "super user" access to, it has to be called confluence-admins? Any particular reason for the limitation?

If I were to have 2 groups in different LDAP directories both called confluence-admins, how would Confluence handle it?

Bill Bailey Community Champion Jun 15, 2017

Yes, that was what I was trying to say. There are two manadatory groups assigments for Confluence: confluence-admins and confluence-users. You cannot rename them. I figured this out the hard way.

It just seems so unneccessarily limiting. This doesn't apply in JIRA.

Ann, would having a groups called confluence-admins on two LDAP directories simulatneously cause any issues?

 

Thanks

Ann Worley Atlassian Team Jun 20, 2017

Please read this documentation about the effect of the directory order and the aggregating group memberships setting:

Effect of Directory Order

Please note that the doc says:

"Before you move an external directory above Confluence's internal directory, make sure you (and your admin users) are members of a group called confluence-administrators in your external directory or you may accidentally lock yourself out of the Confluence admin console."

So my best bet is probably to:

1) Ensure I have a working admin account on the Confluence Internal directory.

2) Rename the group on the LDAP Directory we want to decommission, then sync.

3) Create the new group on the new LDAP Directory and then sync that?

Ann Worley Atlassian Team Jun 20, 2017

For 1:

  • Only if you are using JIRA for Confluence user management, otherwise make sure you have a user in the confluence-administrators group in the Confluence internal directory

For 2:

For 3:

  • Yes, if you are using LDAP groups and not the "Read-only with local groups" option.

For the future: I look forward to any follow-up questions.

 

Sorry, that was a mistake in 1), I meant Confluence local user.

 

I'll let you know how I get on.

Ann Worley Atlassian Team Jun 20, 2017

Awesome, thanks!

Looks to have all gone fine. Thanks for your help.

As a suggestion, can we have the ability to use any group for admin in future, like we can in Jira. This has made a right mess of our AD naming convention!

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted Monday in Confluence

Organizing your space just got easier - Page Tree Drag & Drop is here

Hi Community! I’m Elaine, Confluence Product Manager. You may have read my earlier post about page tree in space navigation sidebar. I'm excited to share another improvement that helps you organize ...

144 views 3 4
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you