This page last changed on Sep 06, 2011 by pwatson.
Permissions determine the actions which a user is allowed to perform within Confluence. Global permissions are one of the levels of permission provided by Confluence. In order to assign these permissions, you must already have the global 'Confluence Administrator' or 'System Administrator' permission (described below). You can then assign global permissions to groups, individual users and anonymous users. Further permissions are granted from the space administration screens. On this page: Overview of the Global PermissionsGlobal permissions control access across the whole Confluence site. Here is a list: Global Permission | Description |
---|
Can Use | This is the most basic permission that allows users to access the site. Users with this permission count towards the number of users allowed by your license. See the information on removing/deactivating users. | Attach Files to User Profile | This allows the user to upload files to be stored in their user profile. This feature was made obsolete by the introduction of personal spaces in Confluence 2.2. Hence, this permission is no longer relevant. Attachments can be accessed from a user profile view (for example, an image within the 'About Me' field of a profile view) by attaching these files to a page within that user's personal space and referencing them using appropriate wiki markup code. | Update User Status | This allows the user to update their user status message, which can be seen on the user's profile, pages in their personal space and on various activity streams accessible to other Confluence users. | Personal Space | This permission allows the user to create a personal space. | Create Space(s) | This permission allows users to create new spaces within your Confluence site. When a space is created, the creator automatically has the 'Admin' permission for that space and can perform space-wide administrative functions. | Confluence Administrator | This permission allows users to access the 'Administration Console' that controls site-wide administrative functions. Users with this permission can perform most, but not all, of the Confluence administrative functions. See the comparison of 'System Administrator' and 'Confluence Administrator' below. | System Administrator | This permission allows users to access the 'Administration Console' that controls site-wide administrative functions. Users with this permission can perform all the Confluence administrative functions, including the ones which the 'Confluence Administrator' permission does not allow. See the comparison of 'System Administrator' and 'Confluence Administrator' below. Refer also to the note about the 'confluence-administrators' group below. |
 | The first system administrator is defined during installation
During the initial configuration of Confluence, the Setup Wizard asks for the username of the System Administrator. This user will have the 'System Administrator' permission and will be a member of the 'confluence-administrators' group. |
Comparing the System Administrator with the Confluence Administrator PermissionNew with Confluence 2.7 and later comes the ability to have two levels of administrator in Confluence: - System Administrator – Users with this permission can perform all the Confluence administrative functions, including the ones which the 'Confluence Administrator' permission does not allow.
- Confluence Administrator – Users with this permission can perform most, but not all, of the Confluence administrative functions.
Tip: The two-tier administration is useful when you want to delegate some administrator privileges to project managers or team leaders. You can give 'Confluence Administrator' permission to users who should be able to perform most administrative functions, but should not be able to perform functions that can compromise the security of the Confluence system.
The following functions are excluded from the 'Confluence Administrator' permission: Administration Screen | Excluded Function |
---|
General Configuration | The following functionality is disallowed: - Server Base URL
- Remote API plugin
- Public Signup
- Connection Timeouts
| Security Configuration | The following functionality is disallowed: - External user management
- Append wildcards to user and group searches
- Public Signup
- Anti XSS Mode
- Enable Custom Stylesheets for Spaces
- Show system information on the 500 page
- Maximum RSS Items
- XSRF Protection
| Plugins | The following functionality is disallowed: - Upgrade
- Install
- Confluence Upgrade Check
| Daily Backup Admin | This function is disallowed entirely. | Mail Servers | This function is disallowed entirely. | User Macros | This function is disallowed entirely. | Attachment Storage | This function is disallowed entirely. | Layouts | This function is disallowed entirely. | Custom HTML | This function is disallowed entirely. | Backup & Restore | This function is disallowed entirely. | Logging and Profiling | This function is disallowed entirely. | Cluster Configuration | This function is disallowed entirely. | Scheduled Jobs | This function is disallowed entirely. | Application Links | This function is disallowed entirely. |
Comparing the Administrator Permissions with the confluence-administrators GroupThe 'confluence-administrators' group defines a set of 'super-users' who can access the Administration Console and perform site-wide administration. Members of this group can also see the content of all pages and spaces in the Confluence instance, regardless of space permissions. They cannot immediately see the pages for which they are excluded by page restrictions without knowing the direct URL to the page (restrictions can be removed by members of the confluence-administrators group in the Space Admin screen if need be). For example, they will not see restricted pages displayed by the children macro. But they are able to access restricted pages directly using the page URL. The settings on the 'Global Permissions' screen do not affect the powers allowed to members of this group. Granting the 'System Administrator' or 'Confluence Administrator' permission to a user will not automatically grant the user access to all spaces in the site. These permissions will only give access to the Administration Console. Be aware, however, that users with 'System Administrator' can add themselves to the 'confluence-administrators' group and become a super-user.  | Confluence Administrator permission and confluence-administrators group are not related
Going by the names, you would think the 'confluence-administrators' group and the 'Confluence Administrator' permission are related – but they are not. To resolve confusion, we want to make explicit that granting a user or group 'Confluence Administrator' permission is not the same as granting them membership to the 'confluence-administrators' group. Granting the 'Confluence Administrator' permission enables access to only a subset of the administrative functions. Granting membership to the 'confluence-administrators' group, on the other hand, gives complete access. |
Read more about global groups. Updating Global PermissionsTo view the global permissions for a group or user: -
Go to the Confluence 'Administration Console':
- Choose Browse > Confluence Admin. The 'Administrator Access' login screen will be displayed.
- Enter your password and click Confirm. You will be temporarily logged into a secure session to access the 'Administration Console'.
- Select Global Permissions in the Security section of the left-hand panel. The View Global Permissions screen appears.
Add or edit group and user permissions as follows: To add permissions for a group: - First add the group to Confluence, if you have not already done so.
- Click Edit Permissions. The 'Edit Global Permissions' screen appears, as shown below.
- Enter the group name in the Grant browse permission to box in the 'Groups' section. You can search for the group name.
- Click Add.
- The group will appear in the list and you can now edit its permissions.
To add permissions for a specific user: (Consider adding the user to a group and then assigning the permissions to the group, as described above, instead of assigning permissions to the specific user.) - First add the user to Confluence, if you have not already done so.
- Click Edit Permissions. The 'Edit Global Permissions' screen appears, as shown below.
- Enter the username in the Grant browse permission to box in the 'Individual Users' section. You can search for the username.
- Click Add.
- The username will appear in the list and you can now edit its permissions.
To add or edit the permissions for a user or group: - Select, or clear, the check box under the relevant permission in the row for the relevant user/group. A selected check box indicates that the permission is granted.
- To allow anonymous access to your Confluence site, select the 'Use Confluence' and 'View User Profile' options in the 'Anonymous Access' section.
For more information about these permissions, refer to Setting up Anonymous Access. - Click Save All to save your changes.
Screenshot: Editing global permissions 
 | About some error messages you may see
In Confluence 2.7.2 and later, Confluence will let you know if there is a problem with some permissions. In rare situations, you may see the following error messages below a permission: - 'User/Group not found' — This message may appear if your LDAP repository is unavailable, or if the user/group has been deleted after the permission was created.
- 'Case incorrect. Correct case is: xxxxxx' — This message may appear if the upper/lower case in the permission does not match the case of the username or group name. If you see a number of occurrences of this message, you should consider running the routine supplied to fix the problem.
|
No content found for label(s) confluence-usermanagement. |

|