Change the built in Admin "super-user" account
Asked by Miles Hayler:

We have recently changed our login directory from one domain to another and want to change the Admin group with the "Special permissions" and admin access everywhere to a group in our new login domain but I can't figure out how this is done.

Thanks


Answers:
author: AnnWorley
body: If you want to use LDAP groups to set permissions that works fine but please include a group called confluence-administrators in the LDAP directory you migrate to. If you cannot get that group created in LDAP, consider making your LDAP user directory "read-only with local groups" so you can add your admins to the confluence-adminstrators group in the Confluence Internal directory. This article explains in more detail: [Confluence Admin Permission Levels Explained](https://confluence.atlassian.com/confkb/confluence-admin-permission-levels-explained-604209420.html)

"The confluence-administrators group defines a set of "super users" who can access the Administration Console and perform site-wide administration. Members of this group can also see the content of all pages and spaces in the Confluence instance, regardless of space permissions."

comments: author: Miles Hayler
body: So I can't specify a different group to give the "super user" access to, it has to be called **confluence-admins**? Any particular reason for the limitation?

If I were to have 2 groups in different LDAP directories both called **confluence-admins**, how would Confluence handle it?


author: Bill Bailey
body: Yes, that was what I was trying to say. There are two manadatory groups assigments for Confluence: confluence-admins and confluence-users. You cannot rename them. I figured this out the hard way.


author: Miles Hayler
body: It just seems so unneccessarily limiting. This doesn't apply in JIRA.


author: Miles Hayler
body: Ann, would having a groups called **confluence-admins** on two LDAP directories simulatneously cause any issues?

Thanks


author: AnnWorley
body: Please read this documentation about the effect of the directory order and the aggregating group memberships setting:

[Effect of Directory Order](https://confluence.atlassian.com/doc/managing-multiple-directories-229838494.html#ManagingMultipleDirectories-EffectofDirectoryOrder)

Please note that the doc says:

"Before you move an external directory above Confluence's internal directory, make sure you (and your admin users) are members of a group called confluence-administrators in your external directory or you may accidentally lock yourself out of the Confluence admin console."


author: Miles Hayler
body: So my best bet is probably to:

1) Ensure I have a working admin account on the Confluence Internal directory.

2) Rename the group on the LDAP Directory we want to decommission, then sync.

3) Create the new group on the new LDAP Directory and then sync that?


author: AnnWorley
body: For 1:

* Only if you are using JIRA for Confluence user management, otherwise make sure you have a user in the confluence-administrators group in the Confluence internal directory

For 2:

* I am sorry to report that Confluence cannot pick up group renames from LDAP:[Inability for Crowd to detect renamed LDAP groups as Crowd does not track using its LDAP IDs yet](https://jira.atlassian.com/browse/CWD-4763) The bug is for Crowd but Confluence uses embedded Crowd and is subject to the Crowd bugs.
* If you disable the LDAP directory it will not matter that the group exists there.

For 3:

* Yes, if you are using LDAP groups and not the "Read-only with local groups" option.

For the future: I look forward to any follow-up questions.


author: Miles Hayler
body: Sorry, that was a mistake in 1), I meant Confluence local user.

I'll let you know how I get on.


author: AnnWorley
body: Awesome, thanks!


author: Miles Hayler
body: Looks to have all gone fine. Thanks for your help.

As a suggestion, can we have the ability to use any group for admin in future, like we can in Jira. This has made a right mess of our AD naming convention!


author: Thomas Schlegel
body: Hi Miles,

you configure the basic Jira-admin permissions here:

http://\<your-jira-url\>/secure/admin/GlobalPermissions!default.jspa

There you can add the admin permissions to new groups. But be careful to not lose your own admin permission by doing this!


author: Bill Bailey
body: I am assuming you are referring to LDAP? As long as whatever group your admins are in, are also members of confluence-admins, you are good to go.

comments: author: Miles Hayler
body: Thanks for the reply. **confluence-admins** is on a different LDAP domain, the one we're trying to decommission.


Tags: active-directory

administration

confluence-administration

group

login

user-management