I have an internal directory set up and imported the data from Confluence into it. I've set the password on the "chardiker" user as that doesn't get imported. This user is in the adaptavist-staff group but not the demo-users group.

I have created an application called "adaptavist-test" which is for our test wiki. I have added the directory and set "Allow all to Authenticate" to false, I add the "demo-group" group and set it to active. I update and try out chardiker's details ... they pass, where I would have expected it to fail.

Am I missing something? I want only the users from the demo-users and adaptavist-administrators groups, but it seems to be successfully authenticating against any user in the added directories, regardless of the "Allow all to Authenticate" flag, or the groups (even when I add adaptavist-staff explicitly and set it to inactive).