Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-24786

Provide Confluence support for Active Directory's "Account Disabled" flag

XMLWordPrintable

    • We collect Confluence feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      It should be tied to Confluence's concept of an "Active" flag.

      Currently, disabled/deactivated AD users are synced to Confluence like other active AD users. They are still considered as an active users in Confluence and hence will be counted towards the license. However, the authentication against AD would of course fails. It'd be nice if Confluence can flag these users as "Disabled" users.

            [CONFSERVER-24786] Provide Confluence support for Active Directory's "Account Disabled" flag

            Mark Lassau (Inactive) added a comment -

            pcurren CWD-995 is solved in Crowd 2.7, so Confluence should work with emb crowd 2.7, I think that is Confluence v5.3?

            Mark Lassau (Inactive) added a comment - pcurren CWD-995 is solved in Crowd 2.7, so Confluence should work with emb crowd 2.7, I think that is Confluence v5.3?

            HuseinA added a comment -

            quoting gutch comment from CWD-995 that I tested in Confluence 4.1.5 and it did indeed help!

            There is a workaround that might be suitable until a full solution is implemented. Set the 'User Object Filter' on the directory in Crowd to:

            (&(objectCategory=Person)(sAMAccountName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

            This excludes users who have the UF_ACCOUNTDISABLE flag set, which is the flag that Active Directory sets when you disable an account.

            Note that Confluence seems to be able to do this completely only on full sync which currently can only be triggered by a restart.

            HuseinA added a comment - quoting gutch comment from CWD-995 that I tested in Confluence 4.1.5 and it did indeed help! There is a workaround that might be suitable until a full solution is implemented. Set the 'User Object Filter' on the directory in Crowd to: (&(objectCategory=Person)(sAMAccountName=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) This excludes users who have the UF_ACCOUNTDISABLE flag set, which is the flag that Active Directory sets when you disable an account. Note that Confluence seems to be able to do this completely only on full sync which currently can only be triggered by a restart.

              Unassigned Unassigned
              doflynn David O'Flynn [Atlassian]
              Votes:
              10 Vote for this issue
              Watchers:
              14 Start watching this issue

                Created:
                Updated:
                Resolved: