User access permissions

[Sol]

Hello Community,

We now have a scenario where there are external users added who require edit access to specific pages and/or on our confluence. We have the core group of users who it'd be fine to access most spaces but not this group of external users. I've read that confluence is inherently designed for all-access content (default confluence-users has edit as default across any space). But it now seems as though I'd need to reverse engineer the access permission in order to accomplish this restricted access requirement. 

If I'm not mistaken I would have to: 

1. Create a similar group to confluence-users, such as: core-team
2. Go through every space we have and edit permissions to remove access to confluence-users and add replace those permission for core-team.
   
3. Any external users added would then need their own group such as: external-company-x and this added to the specific space or page for restricted access

From what I can see this would be the way to get a handle on access permissions within confluence. Would I be correct? 

I've done quite of bit of searching and wondered if there's someone who could shed a bit more light on this for me or give me some advice. 

Many thanks 

[marc -Collabello--Phase Locked- · Accepted solution]

Hi @Sol ,

In principle your approach should work.  However I would do it slightly different:

1. Add all external users to the group "external-users"
2. Make sure external users are not in "confluence-users"
3. Make a new space "external-space" and add edit permissions to the group "external-users"

By using a space as a boundary it is much easier to keep overview of who has access to what.

[Sol]

Thanks for the reply, I have a couple questions. 

From my experience turning off "confluence-users" blocks users from accessing confluence at all. Is that incorrect? 

Adding them to an external space would simply mean sharing the relevant pages into that space? Currently, these external users need to access a handful of pages in a larger space already populated...

Many thanks 

[marc -Collabello--Phase Locked-]

To answer your follow up questions:

From my experience turning off "confluence-users" blocks users from accessing confluence at all. Is that incorrect?

Yes, by default.  You would need to give the new group explicitly product access.

Adding them to an external space would simply mean sharing the relevant pages into that space?

Yes, the pages would have to live in separate spaces.