I want to block access to Space Tools > Permissions, but leave other access

[Rosalind BANWELL]

Hi all

We want to ensure that users are not added to spaces by error. To do this we need to limit access to Space Tools > Permissions for Space Administrators BUT leave rights to other items.

Is this possible?

Thanks, Rosalind

[Daniel Eads _unmonitored account_]

Slightly less simple answer:

• It could be done at your reverse proxy (nginx, Apache, IIS) by matching the space permissions page and applying some rule - e.g. only certain IP addresses can access the page, only display the page if the username section in part of the page matches a certain list, etc. This would be a bad way to go about this and likely cause problems for your System Administrators. Don't do this.
• Some functions can be delegated - there are plenty of plugins for Jira that authorize non-admins to do certain things. This is the only one for Confluence right now, but might be an option depending on your situation
• You could potentially apply some javascript to hide the Permissions button in the Space Tools menu. This wouldn't prevent people from getting there through other routes (like just clicking the Permissions tab when they're already doing some other space administration task).

Confluence is generally open by design to encourage people to collaborate. What other items do your space administrators regularly do? If you don't want them to be able to add users to the space, should they be doing other space administrator tasks? Can you achieve the same results by a short bit of training - if your company's policy is "don't add people to spaces", it wouldn't take but a couple minutes to show people how to not add permissions. And then as Thomas said very well, you're going to have to trust the people you've given space administrator privileges to.

Cheers,
Daniel

[Rosalind BANWELL]

Yes, we'd thought as a last resort about hiding ways to access the Permissions page.

Our Space Admin users still need to be able to modify CSS, create templates and blueprints, modify the sidebar, etc.

Our IT security team are concerned about potential errors being made that add customers/partners to spaces that contain restricted information... we have already limited Space Admin on these spaces...

[Daniel Eads _unmonitored account_]

Hmm. After thinking about this a little more on the way in to the office this morning (ahh, zen highway driving) it seems prudent to make another generic suggestion.

If you're finding this is a big enough issue that you want to spend money on it, Wittified (creators of many "delegated administration"-type plugins) could be contacted to build something for you. Or any other partner that does plugin development: https://www.atlassian.com/partners/search?page=1&expertise=Custom%20Development (select a country to get results)

[Minh Tran]

@Rosalind BANWELL I don't think Confluence supports for such ability.

[Rosalind BANWELL]

Ok, thanks :-(

[Thomas Schlegel]

@Rosalind BANWELL - simple answer: no.

You have to trust your space administrators.

[Rosalind BANWELL]

Ok, thanks :-)