Not all users of LDAP group are also Space Admins

[Adrian Wyssmann]

I use LDAP synchronization for user authentication and therefore I assigne user groups to grant permissions. Unfortunately I have the problem that not all users of the user group get the appropriate permissions applied.

So let's say I have a group "ACL_CONF_SPACE1" which contains 10 users. I assigne the "ACL_CONF_SPACE1" to "SPACE1" and grant all permissions.

Some of the 10 users are actually able to admin the space where are others are not. Any clue what may be the problem?

[Davin Studer]

Are some of them in another group as well that does not have full permissions? If so that is likely why. I'm pretty sure deny permissions trump grants.

[Adrian Wyssmann]

This applies for all users - also the ones having admin access. Basically there are a bunch of ACLs applicable from the LDAP but obliviously I only grant admin access to a particular ACL per space.

For the other applications no permissions are set at all

All users are per-default in the confluence-users group, which do not have admin access on the spaces.

However, when comparing the users the users who have admin access and the ones who have not it appears that they have the same set of ACLs assigned to their user.