Space Privacy - FAQ

Can I use Space Privacy in any number of Confluence instances?

An app's license can only be used in one Confluence instance. You can create as many extranet spaces as you'd like. In order to use Space Privacy in other Confluence instances, you will need to obtain another license. The required license tier is based on the number of users in the Confluence instance.

Why are users visible, when they should not be visible?

The most likely cause is a misconfiguration or a third party app, that adds custom views to Confluence which are not supported by our app.

Please go through the following steps to figure out if your configuration has resulted in the unwanted user visibility:

1. Are the affected users assigned to an extranet space? The global setting: Who can see and find users that are not assigned to an extranet space? has the option All users. Only extranet users are restricted to search and view other extranet users.
2. Is it possible to see other users in the Confluence user directory (path: /browsepeople.action) and view their profiles? In this case, the user has permissions configured to the see the other user.
   
3. Are the users assigned to the same extranet space? Users who share the same extranet spaces, can collaborate and are allowed to see each other. Please consider that users also can be assigned to extranet spaces via Confluence groups.
4. Is the user, who can see "too many" users, a Confluence administrator or has the administrator role "Extranet Manager" or "Extranet User Manager" in one of your extranet spaces? In this case, the user must be allowed to see all other users to be able to manage the extranet space. Only assign administrator roles to users that should be allowed to see all other users.

If none of the steps above find the cause of your problem, it is either an unsupported feature from a third party app or a problem with your Space Privacy app. In both cases, please send a report to our app support team: https://seibert.biz/apphelp

I would like only users that work in the same extranet spaces to be able to see each other. Internal and external users cannot be differentiated by the system.

 

This situation often occurs in pure extranet instances.

Only global administrators, space administrators and extranet user administrators have access to all users, so that assigning them to extranet spaces is possible. Until a user is assigned, they won’t be able to see any other users in the system.

This is especially useful, if adding external users is a process that’s independent from Confluence - in enterprises, employees often have to ask IT to add external users. Before one of those external users is added to an extranet space, they should not have access to other users and vice versa, which is why the previously mentioned option should be selected in the app configuration.

 

 

I want to run an intranet and extranet in the same instance and make sure that external users can only see employees who they work with. At the same time the employees themselves should be able to continue working without visibility restrictions.

 

1. Edit the app configuration so that only global administrators, space administrators and extranet user administrators can access all user data.

2. Create a dummy extranet space.

3. Assign the groups that represent the internal users (employees) to this extranet space, e.g. “all-employees”, “internal-users” etc. Often, these users are from the connected LDAP (directory service), for example Active Directory (Microsoft). Space Privacy updates the group memberships, so that when users are removed from an assigned group, also lose the access to the corresponding extranet space.
   
   As a result, all internal users still see each other and can use Confluence as usual.
   
   

4. If you also want your employees to work with external users, add the relevant users or groups to the respective extranet spaces.
   
   Only users that share one (or more) extranet spaces with external users, can be seen by them. This also applies to other external users (often locally managed) and internal employees of your company.

We already have a user story for a solution that does not require an extranet dummy in our backlog. However, we have not yet planned its implementation. Please contact us, if you are interested in sponsoring this development.

 

 

 

Is it possible to add users to more than one extranet space?

Yes. You can assign users to an unlimited number of extranet spaces. This does not impact the security of any user data.

If user 1 was assigned to extranet spaces A and B, they can view all user data of the other users assigned to those spaces.

Can I build an extranet in my existing Confluence intranet with Space Privacy?

Yes. This is possible with Space Privacy, but not recommended. If you wanted to work with external users from extranet spaces within your normal intranet instance, you might want to re-think your custom infrastructure. Internal users can work securely outside the company's premises within your normal Confluence instance if you use a company VPN. Depending on your specific requirements, we would normally recommend that you set up a separate Confluence system for your extranet.

Am I able to set up custom permissions for each user?

There are five different permission roles that you can assign to any group or single user. In our experience, these assignable roles cover most of the permission requirements for extranets.
If the default roles do not fit your needs, you can customize one in the global app administration under the tab User Roles.
Click on "Edit" to customize a role and set the permissions as you need.

Caution: Changes in permission apply to all available extranet spaces - including existing spaces.

What rights can I assign to an extranet user?

There are five different permission roles that you can assign to any group or single user. In our experience, these assignable roles cover most of the permission requirements for extranets.
If the default roles do not fit your needs, you can customize one in the global app administration under the tab User Roles.
Click on "Edit" to customize a role and set the permissions as you need.

Caution: Changes in permission apply to all available extranet spaces - including existing spaces.

Can an extranet space be managed by a Confluence or space administrator?

No. There are three types of extranet administrator roles that Space Privacy uses:

• The extranet administrator can manage both the users in the extranet spaces, as well as the extranet spaces themselves.
• The administrator can manage the extranet space, but cannot add or remove users.
• The extranet user administrator can manage users in the extranet space, but not the extranet space itself.

Our users are not locally managed in Confluence, but rather centrally with LDAP – can Space Privacy still be used? 

Yes, the app includes LDAP users as long as this was configured in the Confluence administration. This also applies to Atlassian Crowd or Jira Servers as a user directory.

However, it is absolutely necessary for local groups to be allowed, as Space Privacy creates groups for every extranet space. Users that are assigned to extranet spaces, are added to their corresponding groups.

See how to set up user directories so they grant the required permissions for Space Privacy: User Directory Configuration

If you have any questions about this, please don’t hesitate to ask us. We would love to help you!

Which features are secured by Space Privacy?

 Our app aims to secure every standard Confluence UI component that is not added by third-party apps. Some third-party apps are supported, if they use standard interfaces (e.g. for user search). Please let us know about problems you find with third-party apps, so that we can evaluate possible solutions. (https://seibert.biz/apphelp)

Space Privacy not only secures content via Confluence permissions. It also makes sure that only users who have at least one extranet space in common, can see each other in the system. For content permissions, the app uses Confluence space permissions. You don’t have to assign your custom permissions in extranet spaces: this would be counterproductive because it avoid the extranet user administration entirely.

The restricted visibility of users between extranet spaces is only possible through our app. Thus, when you deactivate the app all users will be visible to each other. Assigned content permissions remain as they were set.

Our security concept:

• Visibility of extranet users is bidirectional except for administrative roles (confluence administrator, extranet administrator, extranet user administrator). If user Alice can see user Bob, user Bob can see user Alice. The administrator Charlie can see Alice and Bob, even though they might not share an extranet space.
• Visibilities are different for global features (user profile, search, people directory) and space features (@-mentions, share page).
• In global features (user profile, search, people directory) a extranet user can see every user, with whom he shares an extranet space. Alice is assigned to the extranet spaces A and C, Bob to B and C. That’s why they can find each other using search, or view each other's profiles.
• For space features (@-mentions, share page) a user can only interact with extranet users that are also assigned to the current extranet space. Alice is assigned to extranet spaces A and C, Bob to B and C. They can both mention and notify each other in the extranet space C via @-mentions and share pages, but not in the extranet spaces A and B.

You can find more information regarding global and space features in FAQ answers: "What are global features and which of them are secured?" and "What are space features and which of them are secured?".

What are global features and which of them are secured?

Global features are UI components or technical interfaces, that are not restricted to a single space. The Space Privacy app ensures that users can see only those users who have at least one extranet space in common. Users in an administrative role (Confluence administrator, extranet administrator or extranet user administrators) always see every user in the system, as this is necessary to perform their roles.

At the moment, the following features and interfaces are secured:

• User profiles
• Global search
• Search bar (quick search)
• People directory -/browsepeople.action
• User search in search filters (contributor, creator, network/contacts)
• Macros: Livesearch, User List, User Profile, Content by User
• Personal spaces (this should be covered by content permissions, but in case of a faulty configuration, we intervene)

The following features in combination with the Linchpin Intranet Suite are only recommended with restrictions or not at all:

• Activity Stream/Recently Updated/All Updates

What are space features and which of them are secured?

Space features are Confluence features that can only be used in spaces.

The Space Privacy app ensures that users can see only those users who have at least one extranet space in common. This prevents accidental interaction with users that don’t have access to the current extranet space. Regarding space features, even users in administrative roles (Confluence administration, extranet administrators or extranet user administrators) can not interact with users that are not assigned to the current extranet space.

The following space features are secured:

• Mentioning users (@-mention)
• Sharing pages

Which apps does Space Privacy support?

Apps that access user data or labels are impacted by Space Privacy - for example apps that can integrate their own people directory or use @-mentions.

Is Space Privacy compatible with Custom Space User Management (CSUM)?

In principle, the two apps do not restrict each other, but the interfaces provided by the CSUM are not filtered by Space Privacy. Depending how you use both apps, this may or may not be a problem.

In concrete terms, this means that users can be found and assigned in the CSUM tab to a space that the logged in user does not actually know about (see the user directory).

When is that a problem?

1. When there are external extranet user administrators. They should only know about users who work in the same extranet spaces to which this user (administrator) has access. However, they can see all users via "Add User" in the CSUM app.
2. When there are space administrators who are not authorized in Space Privacy (when they are neither extranet user administrators nor extranet space administrators) and are not allowed to see all users in the system. But this space administration can see all users via "Add User" in the CSUM app.

Both situations are rather rare - the second probably would not occur in practice. For the standard use case where there are only internal extranet administrators/space administrators, there would be no security concerns.

Note: Groups created by Space Privacy cannot be used by the CSUM app.

What do I have to keep in mind regarding export and import with Space Privacy?

You can export and import systems that use Space Privacy. Nevertheless you should keep the following in mind:

• When you export and import, the same version of the app should always be used, otherwise updated features might cause problems.
• Use the global export feature.
• Do not export extranet data.

Which versions of Confluence is Space Privacy compatible with?

Confluence Server 6.6.0 - 7.2.0

How do I submit an issue?

Before you submit an issue with the Space Privacy app, please try to solve your issue with the following steps:

1. Reload the page.
2. Deactivate and activate the app (this is not 'magic' - heath checks are run when the app is activated).
3. Only if you see the message: "Indexing User...": Rebuild the Confluence search index (Confluence Administration > Content Indexing).

If none of the steps above fixes your problem, please submit an issue (https://seibert.biz/help) with your application logs to help our analysis and find the cause of the problem:

1. Set the log level for the key net.seibertmedia.extranet to DEBUG. Use the logging administration (Confluence Administration > Logging and Profiling) to add net.seibertmedia.extranet as the new logging key.
2. Repeat the steps that caused the error - this will generate useful logs.
3. Generate a Support ZIP (Confluence Administration > Support Tools - Atlassian Documentation)
4. Export the Space privacy configuration from Confluence Administration > SPACE PRIVACY: Maintenance & Support
5. Submit an issue and attach your support zip + Space privacy config: https://seibert.biz/help 

What happens if I delete an extranet space?

Deleting an extranet space will trigger the app to remove all related Space Privacy data for this space.

This means that extranet users who are only assigned to this space, might lose their "use Confluence" permission.