How to give space access to unlicensed users

[Nicolas Gueuning]

In the global permission of our Confluence - I can read that about :

Unlicensed Access

Allow any active user, including those who don't have a Confluence license, to view spaces (for example, users from Jira Service Desk). You can choose which spaces unlicensed users can view. If you disable this permission, it can only be enabled again through Jira Service Desk

Question:

And so I would like to give access to our active Jiras users (not service desk users) a unlicenced access in a view mode only to some of our confluence space.

How can I do that ?

Should I make the space public (anonymous) and so anyone can have access to it ? Or can I restrict it only to our Active Jira users ?

Thanks for your help

[Bill Bailey]

The easiest way is to enable anonymous access, set to view only. My understanding is that any other group restriction would require a user account. Maybe you could have a single account for all Jira users set to view only? Or place your instance behind a reverse proxy that requires authentication if you want to be more restrictive.

[Seth Freeman]

We have enabled anonymous access and anonymous space view permissions, but unlicensed logged in users (we link to LDAP) are unable to view the pages.

[David Platt]

I am having this same issue. Logged in users that don't have a Confluence license are unable to view spaces other than the one linked to Jira. Have you found a solution for this?

[Nic Brough -Adaptavist-]

There are three ways to get to see a page in Confluence (to keep it simple, ignoring page restrictions)

1. You are logged in as a Confluence user, and you have "use" permission in a space
2. You are logged into a Jira service desk as a customer, and that desk is linked to a knowledge base space
3. You are not logged in at all, global permission is granted for anonymous access, and the space has anonymous access enabled too. 

I suspect it's the third one - that's not about licences, the person must not be logged in at all - if they're a customer or logged into Jira with SSO and a shared account (even one without a licence), Confluence knows who they are, and they are hence not anonymous.  (This one is hideously confusing, and in my opinion, wrong)

[David Platt]

I agree @Nic Brough -Adaptavist-. The difficulty I have is that the wording suggests that multiple spaces can be accessed by unlicensed users (scenario 2 in your message above). In Confluence Administration > Global Permissions, it says 

Unlicensed Access

Allow any active user, including those who don't have a Confluence license, to view spaces (for example, users from Jira Service Desk). You can choose which spaces unlicensed users can view. If you disable this permission, it can only be enabled again through Jira Service Desk.

That wording tells me that it is possible, though I don't know, to choose multiple spaces. I just cannot find any documentation or information to support this.

[贾骏]

It's quite weird that anonymous users can see more than login users unlicensed. Actually anonymous users are unlicensed too. A bank security guy won't stop a masked man go into the vault. As a result I have to asked my employees put mask on their faces.

[Eddy Fras]

I totally agree, why can't we give access to specific spaces to unlicensed but logged in users when we can do it for anonymous users ?

I don't want to activate anonymous access globally, this is too far permissive when you have lots of space administrators on your server.

Please Atlassian, unlock this unlicensed users feature to all spaces, not only spaces declared as KB for JSD projects !

[Nic Brough -Adaptavist-]

Because an un-licenced user cannot log in.   Un-licenced is anonymous, by definition.

[Deniz Oğuz]

Hi Nic,

Unfortunately un-licensed user is not anonymous once they login to your site. My customers can't access to our support documentation if they login to our support. Because they don't have Confluence license. Only solution is to recommend users to open a new private window and access to support documentation anonymously. 

[Eddy Fras]

@Nic Brough -Adaptavist- I clearly disagree with "Un-licenced is anonymous, by definition", a user can definitely login without a license on Confluence until he has an active account.

Such a user is unlicensed AND not anonymous.

[Nic Brough -Adaptavist-]

@Deniz Oğuz-

>Unfortunately un-licensed user is not anonymous once they login to your site"

Yes, that's what I said.  Once they've logged in they're not anonymous and you know who they are

@Eddy Fras 

>a user can definitely login without a license on Confluence 

You can connect to it without logging, but once you log in, you are known to the system, and to log in, you have to be in the "can use" group, which means you are consuming a licence. 

If you are unlicenced, you are, by definition, not logged in, and hence anonymous.

Anyway, yes, it is an oddity that you can log in and suddenly stop seeing spaces that allow anonymous access.  The simple approach is to tell the space admins that when they allow anonymous access, they should also add the "can log in" group to the "use space" permission.

[Eddy Fras]

@Nic Brough -Adaptavist- Sorry, I still disagree :)

You can log in on Confluence without a license and without being in a group with "can use" permission.

Attached, a screenshot of an active user (named Jira User) with a Jira license only, logged on Confluence.

If the user goes to /display/SPACEKEY and this space is a KB linked to a JSD project, he can view it.

He also have access to the main navigation menu on the top left hand corner.

He is not anonymous, he is unlicensed and he is logged in.

[Deniz Oğuz]

My recent workaround for this problem is to create non-public service desk projects and linking these projects to confluence spaces. Since they are now a knowledge base space, they become accessible. 

[Eddy Fras]

Thanks Deniz, that was my idea too. But if I have to create a new fake JSD project for each Confluence space, it's really not practical.

[Deniz Oğuz]

I think Atlassian want to remove anonymous access completely. Our Jira is open for viewing for anonymous users, but recently it stoped working properly. They have created following ticket. 

https://jira.atlassian.com/browse/JRACLOUD-75117

[Luke Wilson]

@Deniz Oğuz could you elaborate on "to create non-public service desk projects and linking these projects to confluence spaces" please? I think I've done this but my jira users still can't access the Confluence pages (without consuming Confluence licences) 

[Deniz Oğuz]

@Luke Wilson It may not be working now. I haven't tested it for a while. Please check https://jira.atlassian.com/browse/CONFSERVER-30161 for more details about the problem. There may be some suggested workarounds. 

[Tom Hawkins]

As a recent migrater from Jira/Confluence Server (where anonymous read only access meant only those who could access our server) to Jira/Confluence Cloud (where anonymous read only  access I believe means open to the internet which isn't appropriate for all of the data which I want our unlicensed JSM customers to be able to view Read Only) I'm facing a similar issue, which I'm planning to address soon, thanks @Deniz Oğuz for your comments and the link to https://jira.atlassian.com/browse/CONFSERVER-30161 which led me to https://jira.atlassian.com/browse/CONFCLOUD-30161 the key question for me is, is it going to be possible to enable unlicensed users who have logged into just ONE JSM portal to access MULTIPLE Confluence spaces (don't mind doing the work to link each of those spaces to "dummy" JSM projects but don't want to have to make each user log into a Portal for each one).