When using LDAP, is it possible to disable certain users

[Dean Gaudet]

We have LDAP as a user Directory. We would like to disable some users. However the Disable option does not show up for any of our users. I'm guessing this is due to us using LDAP.

[AnnWorley · Accepted solution]

Hi Dean,

As you guessed, if the users are managed in a read only LDAP directory they cannot be disabled in Confluence.

One way to deny access to LDAP users is to remove them from groups or individual listings on the Global Permissions page. If a user without the "can use" Confluence permission (granted through a group or individually) attempts to log in they will get a "Not Permitted" message as described in Global Permissions Overview.

Thanks,

Ann

[Dean Gaudet]

Hi Ann, thanks for your reply.

I just double checked my LDAP configuration and I have this option selected: Read Only, with Local GroupsUsers. Which states "groups and memberships are retrieved from your LDAP server and cannot be modified in Confluence. Users from LDAP can be added to groups maintained in Confluence's internal directory."

I believe with this setting I don't have the ability to disable or remove permissions from specific users.

[AnnWorley]

Read only with local groups means that you can control permissions in Confluence by adding and removing users from local groups. If the groups are present in Confluence and not LDAP, you may remove LDAP members from local groups from within Confluence.

If the groups you are using on the Global permission page to grant access are LDAP groups and not local groups, you may remove the users from the groups in LDAP to disable their ability to use Confluence.

The most common configuration is to use confluence-users, a local group, to grant access to most users.

[Dean Gaudet]

My configuration is setup as you described where there is a confluence-users group. However the only options I have in that group is to delete a user. If I delete a user from that group, do you think this will remove the ability for that user to login?

The user still belongs to the LDAP group. So I believe I can only temporarily remove a user until they login again.

[AnnWorley]

If the confluence-users group resides in LDAP the member will need to be removed in LDAP. If the group is local to Confluence, the LDAP member may be permanently removed.

[Davin Studer]

If you set up your LDAP User Schema Settings -> User Object Filter config like such you can disable them through LDAP a couple ways.

(&(objectCategory=Person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(memberOf=CN=confluence-users,OU={Path},OU={To},OU={Users Group},DC={Your Domain},DC={Extension})))

This will only add LDAP users who are members of the LDAP confluence-users group and are enabled for login in LDAP. So you could either disable the user in LDAP or remove them from the group and the user will no longer be able to log into Confluence.

[Dean Gaudet]

Ok, thanks for your information.