• We collect Confluence feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      It should be possible to restrict the visibility of user profiles (home pages). I.e. different customers should not have any idea about accounts of other customers. Now the links to profiles are shown for example in the "Recently Updated" list.

      The permission administration could be implemented in the same way as in the spaces.

            [CONFSERVER-1134] Permissions for user profiles

            A solution for this is available NOW (March 13, 2014) - for Confluence 5.4+.

            Private Parts for Atlassian Confluence is a plugin that suppresses visibility of private usernames when a user is in a restricted space.

            A common use case for this plugin is a Confluence wiki that is being used for "partner management". In such case, the parent company restricts spaces for partners, and does not want other partners to know who else has an account on the wiki. The external partner users should not be able to see other users at all, including any others' username. They can interact on the wiki - but with this plugin, they cannot see others in lookup and share areas.

            With this plugin, out of the box features are controlled as follows:

            • @mention lookups are suppressed - so you can't see anyone.
            • "search for names" will find if you know the name. But no lookup. (In the future, the plugin will allow, per group permissions on find.)
            • "Share" feature works by email address or groups only
            • People Directory menu item is suppressed (so you can't see people you shouldn't see)
            • Since @mention look up is disabled, if you do an @ref in a personal task, it will NOT list the task
            • Disabled "search filter by author"
            • Removed hover cards - over a person
            • Removed follow/unfollow capability
            • Remove Network tab on Dashboard and user profile

            See details and video here:
            http://http://www.appfusions.com/display/PPARTS/Home

            Please email info@appfusions.com to try it out and get an eval license!

            NOTE: Given the user impact, we recommend to install on a staging server first (just as for any new plugin).

            Ellen Feaheny [AppFusions] added a comment - A solution for this is available NOW (March 13, 2014) - for Confluence 5.4+. Private Parts for Atlassian Confluence is a plugin that suppresses visibility of private usernames when a user is in a restricted space. A common use case for this plugin is a Confluence wiki that is being used for "partner management". In such case, the parent company restricts spaces for partners, and does not want other partners to know who else has an account on the wiki. The external partner users should not be able to see other users at all , including any others' username. They can interact on the wiki - but with this plugin, they cannot see others in lookup and share areas. With this plugin, out of the box features are controlled as follows: @mention lookups are suppressed - so you can't see anyone. "search for names" will find if you know the name. But no lookup. (In the future, the plugin will allow, per group permissions on find.) "Share" feature works by email address or groups only People Directory menu item is suppressed (so you can't see people you shouldn't see) Since @mention look up is disabled, if you do an @ref in a personal task, it will NOT list the task Disabled "search filter by author" Removed hover cards - over a person Removed follow/unfollow capability Remove Network tab on Dashboard and user profile See details and video here: http://http://www.appfusions.com/display/PPARTS/Home Please email info@appfusions.com to try it out and get an eval license! NOTE: Given the user impact, we recommend to install on a staging server first (just as for any new plugin).

            AudraA added a comment -

            We recognize the importance of this feature request, and have started to address part of this issue where you can now disable anonymous users from access user profiles. See CONF-13276.

            I am resolving this issue because it is a duplicate of CONF-1882, and will make a note of the 35 existing votes for this issue. Please continue commenting and voting on issue CONF-1882.

            AudraA added a comment - We recognize the importance of this feature request, and have started to address part of this issue where you can now disable anonymous users from access user profiles. See CONF-13276 . I am resolving this issue because it is a duplicate of CONF-1882 , and will make a note of the 35 existing votes for this issue. Please continue commenting and voting on issue CONF-1882 .

            I would love to see this, it would be very valuable for our purposes.

            Timothy James added a comment - I would love to see this, it would be very valuable for our purposes.

            Don Willis added a comment -

            Heikko,
            Email addresses can be hidden in user search. See http://confluence.atlassian.com/display/DOC/User+Email+Visibility
            That may go a small way to fulfilling your requirements.
            Cheers,
            Don

            Don Willis added a comment - Heikko, Email addresses can be hidden in user search. See http://confluence.atlassian.com/display/DOC/User+Email+Visibility That may go a small way to fulfilling your requirements. Cheers, Don

            I would very much like this feature implemented/fixed too.

            The basic idea is that we would like to have an wiki that has some spaces opened for customers who must know the other customers present there.

            And some notes of the current situation - I am almost happy with the setup, after disabling personal spaces, people directory and granting access to correct groups per space. But here's my problem, when I search an username for example "sarah", I still get a list of all people with that name and email. So don't forget search, even "disable searching users" would help.

            Heikko Ellermaa added a comment - I would very much like this feature implemented/fixed too. The basic idea is that we would like to have an wiki that has some spaces opened for customers who must know the other customers present there. And some notes of the current situation - I am almost happy with the setup, after disabling personal spaces, people directory and granting access to correct groups per space. But here's my problem, when I search an username for example "sarah", I still get a list of all people with that name and email. So don't forget search, even "disable searching users" would help.

            Ok, in 1.4.2 I have set-up a group called external-users (with global permission to use Confluence) and have a user "test" with only this group specified.

            Login and navigation is ok, but unfortunately they can still search user profiles.

            Provided each new customer group is given global permissions - would it now be possible to restrict viewing of profiles between groups somehow so that each customer group has it's own space without knowledge of others?

            Amitee Goulton added a comment - Ok, in 1.4.2 I have set-up a group called external-users (with global permission to use Confluence) and have a user "test" with only this group specified. Login and navigation is ok, but unfortunately they can still search user profiles. Provided each new customer group is given global permissions - would it now be possible to restrict viewing of profiles between groups somehow so that each customer group has it's own space without knowledge of others?

            In our installation that doesn't help at all.

            We don't have anonymous access, and all customers granted to use Confluence are members of the "confluence-users" group. Then speace level access control is done by customer specific groups. The same accounts are also used in JIRA (thus many are also members of "jira-user"). This way we can grant access for individual accounts to JIRA and/or Confluence independently.

            Now we have changed the call of "recentlyUpdatedContent" to "recentlyUpdatedPages" in "dashboard.vm". As a side effect the blog posts are also hidden. If an option to exclude specified "common" groups from the comparison requires too much effort, I would at least love to see another function that returns all changes but profiles.

            Teemu Matilainen added a comment - In our installation that doesn't help at all. We don't have anonymous access, and all customers granted to use Confluence are members of the "confluence-users" group. Then speace level access control is done by customer specific groups. The same accounts are also used in JIRA (thus many are also members of "jira-user"). This way we can grant access for individual accounts to JIRA and/or Confluence independently. Now we have changed the call of "recentlyUpdatedContent" to "recentlyUpdatedPages" in "dashboard.vm". As a side effect the blog posts are also hidden. If an option to exclude specified "common" groups from the comparison requires too much effort, I would at least love to see another function that returns all changes but profiles.

            jens added a comment -

            The profiles will not appear under "Recently Updated" on the dashboard in 1.4 if you are an anonymus user. In fact at the moment you have to be an administrator to see the profiles on this list. However, profiles should only be shown to members of the same group.

            Since everybody starts of to be a member of the "conf-users" group, which is not likely to be changed in a public environment where many people access confluence, the profiles would be visible to any user.

            jens added a comment - The profiles will not appear under "Recently Updated" on the dashboard in 1.4 if you are an anonymus user. In fact at the moment you have to be an administrator to see the profiles on this list. However, profiles should only be shown to members of the same group. Since everybody starts of to be a member of the "conf-users" group, which is not likely to be changed in a public environment where many people access confluence, the profiles would be visible to any user.

            We have 1.3.1 and profiles are visible to anonymous users under "Recently Updated" on the dashboard.

            Perhaps an option to restrict visibility of profiles by either people in the same group (or groups if a person is in more than one) or people who can see the same space? However, wouldn't want users to be able to see profiles of people who have posted who are no longer members of the relevant group.

            Amitee Goulton added a comment - We have 1.3.1 and profiles are visible to anonymous users under "Recently Updated" on the dashboard. Perhaps an option to restrict visibility of profiles by either people in the same group (or groups if a person is in more than one) or people who can see the same space? However, wouldn't want users to be able to see profiles of people who have posted who are no longer members of the relevant group.

            This is related / partly duplicates CONF-794

            Sulka Haro added a comment - This is related / partly duplicates CONF-794

              Unassigned Unassigned
              c8e50cd64909 Teemu Matilainen
              Votes:
              35 Vote for this issue
              Watchers:
              24 Start watching this issue

                Created:
                Updated:
                Resolved: