Confluence Scriptrunner: Copy users from space permissions to the local group

[Tomáš Vrabec]

Hi guys,

due to poor architecture when one of my customer started their implementation, they ended in situation with one space and 400+ users INDIVIDUALLY assigned with same permissions.

Now I am in front of "copying" this configuration. 

Need new space, with same permission setup.

I am looking for solution in ScriptRunner to:

1. Get all users listed in permissions
2. Get their keys 
3. Insert them into local group (could be hardcoded, one time action)

I am advanced in Jira ScriptRunner, but kind of newbie in Confluence version.

Confluence 7.4.0

ScriptRunner 6.2.0-p5

Thanks!

[Lee Wonnacott · Accepted solution]

Hi Tomáš!! 

I've added an example script here which should solve the issue you are facing! 

It will iterate through the permissions of a specified space, extract all users with individual view permissions to that space and add them a group of your choosing! 

Once you've got your group set up, you can use the example here to provide the required permissions for this group to your new space.

I hope this helps but let me know if you have any further questions. :) 

Kind regards, 
Lee

[Tomáš Vrabec]

Hi Lee! Thank you for this, I will try that ASAP :-) 

Will let you know, instance is 10000+ automotive users so I have to test it carefully.

[Tomáš Vrabec]

Hi Lee!

Your script is working. I just little bit extend the conditions and made automatic split into 4 types of groups based on permission combinations.

Thanks for guiding me!

Tom

[Tomáš Vrabec]

@Lee Wonnacott 

Hi Lee!

I extended the script and getting errors like this:

2021-02-05 15:47:37,792 ERROR [common.UserScriptEndpoint]: ************************************************************************************* 2021-02-05 15:47:37,812 ERROR [common.UserScriptEndpoint]: Script console script failed: groovy.lang.MissingMethodException: No signature of method: com.sun.proxy.$Proxy119.addMembership() is applicable for argument types: (ArrayList, com.atlassian.confluence.user.ConfluenceUserImpl_$$_jvstb74_3) values: [[ConfluenceUserImpl{name='DZCMDH9', key=8a5935844efbe4a1014f88ebfb970008}, ...], ...] Possible solutions: addMembership(com.atlassian.user.Group, com.atlassian.user.User), hasMembership(com.atlassian.user.Group, com.atlassian.user.User) at Script160$_run_closure4.doCall(Script160.groovy:58) at Script160.run(Script160.groovy:57)

The script itself is:

Any ideas what is wrong?

import com.atlassian.confluence.security.SpacePermissionManager
import com.atlassian.confluence.spaces.SpaceManager
import com.atlassian.sal.api.component.ComponentLocator
import com.atlassian.user.GroupManager

def spacePermissionManager = ComponentLocator.getComponent(SpacePermissionManager)
def spaceManager = ComponentLocator.getComponent(SpaceManager)
def groupManager = ComponentLocator.getComponent(GroupManager)

def groupReadOnly = groupManager.getGroup("cem_conf_read_only")
def groupReadWrite = groupManager.getGroup("cem_conf_read_write")
def groupRestriction = groupManager.getGroup("cem_conf_restrictions")
def groupSpaceOwner = groupManager.getGroup("cem_conf_space_owner")
def groupSpaceAdmin = groupManager.getGroup("cem_conf_space_admin")

def spacePermissions = []
def sourceSpace = spaceManager.getSpace("CMS")

def usersReadOnly = []
def usersReadWrite = []
def usersRestriction = []
def usersSpaceOwner = []
def usersSpaceAdmin = []

spacePermissions = sourceSpace.getPermissions()

spacePermissions.each{ permission ->
if (permission.getUserSubject() && permission.getType() == "VIEWSPACE")
{
usersReadOnly.add(permission.getUserSubject())
}
if (permission.getUserSubject() && permission.getType() == "EDITSPACE")
{
usersReadWrite.add(permission.getUserSubject())
}
if (permission.getUserSubject() && permission.getType() == "SETPAGEPERMISSIONS")
{
usersRestriction.add(permission.getUserSubject())
}
if (permission.getUserSubject() && permission.getType() == "EXPORTSPACE")
{
usersSpaceOwner.add(permission.getUserSubject())
}
if (permission.getUserSubject() && permission.getType() == "SETSPACEPERMISSIONS")
{
usersSpaceAdmin.add(permission.getUserSubject())
}
}

usersReadOnly.each{ user ->
groupManager.addMembership(groupReadOnly, user)
}
usersReadWrite.each{ user ->
groupManager.addMembership(groupReadWrite, user)
}
usersRestriction.each{ user ->
groupManager.addMembership(usersRestriction, user)
}
usersSpaceOwner.each{ user ->
groupManager.addMembership(usersSpaceOwner, user)
}
usersSpaceAdmin.each{ user ->
groupManager.addMembership(usersSpaceAdmin, user)
}

[Tomáš Vrabec]

Nevermind. I can see typo now. :-D 

[Jessie Wang_ScriptRunner_The Adaptavist Group · Accepted solution]

Hi all, the script to do this has now been uploaded to our script library for ScriptRunner for Confluence Server/DC.

Feel free to copy it or customise it for your own needs. https://library.adaptavist.com/entity/copy-users-from-space-permissions-to-a-local-group

[Emanuel Paquetelima]

@Lee Wonnacott 

Hi Lee, how are you?
Look, by the way, is there any way to add multiple users at the same time in the Individual users section in space confluence?

I have so many users to add and I don't want to add them one by one.

Can you help?

[Lee Wonnacott]

Hi @Emanuel Paquetelima!

I'm doing pretty good, yourself?

Would it not be better to add these users to a new Confluence group, then provide that group with permissions to the space in question? 

This would evade the scenario that the OP found themselves in whereby a future admin may have to remove these individuals from the space one by one.

Let me know your thoughts! 🙂

[Emanuel Paquetelima]

Hello @Lee Wonnacott 

Our users are created in AD, mapped to Jira and from Jira are mapped to Confluence.

So there is a policy of not creating user groups per project. We have more than 100 projects and around 2000 users. And each project has its users.

The problem is that, when I have a new project with about 20 or more users to put in space confluence, I have to put them one by one.
Is there a way to create groups within Confluence itself?

Thank you

[Sherry Yang [Venue - The Adaptavist Group]]

Hi @Emanuel Paquetelima,

You could indeed create Confluence Groups as mentioned by @Lee Wonnacott above. You can find info to create new groups here.

Hope this helps.