How to allow View only permission to a Confluence Space?

[Chuck Minarik]

I created a space called "Public" and granted "View" permission to a group called "restricted_users". Then I created a test user and put him in the "restricted_users" group.

However, when I sign on as the test user and try to navigate to a Page in the "Public" Space, I get a "Not Permitted" message. There are no Page Restrictions defined for the Page.

Why is this happening?

[Colin Goudie · Accepted solution]

Sounds like you may also have to add your new group to have confluence use permissions under global permissions.

[Nic Brough -Adaptavist-]

There's several layers of access. In no particular order, you need to think about

Space permissions (Your setup is fine there)

Page restrictions - either on the current page (again, you've got this covered fine), and also on all the pages *above* it in the hierarchy because restrictions cascade to child pages automatically. (Yet again, I suspect you've not got restrictions on parent pages, so you're probably fine, but I mention it just in case you do)

Global permissions - the user needs to be able to log in. Unless you've set anonymous = read.

My first suggestion would be to try setting the space permissions so that anonymous can read it. That will tell you whether it's the global settings or not - if your user suddenly gains access, then that's it. If they don't, then it's time to go over restrictions (or check the space settings really closely)

[Chuck Minarik]

Colin hit it right on the head. As soon as I added the new group in global permissions, my test user was able to see the page in the Public Space.

But I ran into a new problem...How do I restrict access to the Dashboard (our Confluence home page)? When the test user signs in, he sees the same Dashboard everyone else sees. I'd like him to see a blank page (or something similar) everywhere except the Public Space.

[Nic Brough -Adaptavist-]

Yup - you needed to let them "log in" as well as the rest.

You can't restrict access to the dashboard itself, but the dashboard will only display stuff about spaces that the user has the rights to see. If the "public" space has "anonymous" access, but no other spaces do, then the user will only see data related to that one space. It won't be quite an empty page, but the actual space data they can't see won't be there.

I suspect you've got other spaces that allow access for your test user.

[Colin Goudie]

Not sure you can stop them hitting the dashboard out of the box. You can set their default homepage to the public space. But the dashboard should really be only showing them content in the public space if you have correctly only allowed their group to only see the public space.

i.e. The dashboard shouldn't be showing any content that the user's permissions wouldn't let them see

[Chuck Minarik]

Our dashboard contains a rather verbose overview of what is in the wiki. It also contains a list of most recent changes and the user who made the change. The test user doesn't see the description of the change, but the user who made the change is shown, and the test user can get to that user's profile page.

I'd really prefer this not be made available to the test user.

Colin: How do I "set their default homepage to the public space"?

[Nic Brough -Adaptavist-]

Ok. Well, the "stuff that was recently updated by user" will stay, but it won't include content from pages that your restricted user cannot see.

The ability to look at other users profile is not globally restrictable (as far as I know). Atlassian are trying to make Confluence "social", and I don't think it's possible to actively restrict access to any individual's profile by default. Of course, your users can restrict their personal space, but that doesn't solve the problem you have.

I don't think there's a way to set the "default home page" either.

[Bill Goodall]

Looks like User Profiles is now able to be controlled here: https://confluence.atlassian.com/display/DOC/Setting+Up+Public+Access - 5. If you want to allow anonymous users to see user profiles, select the check box in the View User Profiles section.