License restriction and LDAP

[Вадим Дроздов]

I am configured to synchronize users with Active Directory. What is the number of users in the confluence when validating a license? Will the number of users be limited to all are accounts or only to those who have at least authorized? 

[Davin Studer]

If you only want users in the system that are actually able to log in the you can setup a filter in your LDAP config like such ... 

If you put this in User Schema Settings -> User Object Filter it basically says that it will only import users that are users in LDAP that are not disabled and are members of the LDAP confluence-users group. This way ou can user the confluence-users LDAP group as a means of granting access and only LDAP accounts in that group will be added to Confluence.

(&(objectCategory=Person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(memberOf=CN=confluence-users,OU=Confluence,OU=Managed Groups,DC=mydomain,DC=dom))

[Davin Studer]

FYI, you could also do something similar for groups. Under Group Schema Settings -> Group Object Filter you could put something like this. What is basically says is anything in Active Directory that is a group that starts with confluence it will import into Confluence as a group.

(&(objectCategory=Group)(sAMAccountName=confluence*))

[AnnWorley]

Thanks for addressing the root issue, Davin.

More details on LDAP filters and how they work with Atlassian apps: How to write LDAP search filters

[Bill Bailey]

In past versions, only users in the group confluence-users count (and have a login).

[AnnWorley]

Technically, users without can-use permission can log in but they see a page that says "Not permitted".

Please see:

How to get a list of active users counting towards the Confluence license

"Confluence's license count is based on Global Permissions. Users will count towards the license in the following ways:

• If the user is a member of a group that has global permissions to use Confluence
• If the user is individually granted global permissions to use Confluence"

[Nic Brough -Adaptavist-]

It's "anyone who can log in" - so the users must be in one of the login groups (see global permissions) and marked as active