I have 10 users set up but it is showing 11
Asked by Kevin Pelzman:

I have 10 users split between three different groups which have access to different pages. For some reason Confluence thinks I have 11.


Answers:
author: AnnWorley
body: The query I intended should have returned 2 columns, **lower_user_name** and **directory_name**. I am baffled that it returned user and last login for you. To be clear, the query is:

    SELECT DISTINCT u.lower_user_name, d.directory_nameFROM cwd_user uJOIN cwd_membership m ON u.id = child_user_idJOIN cwd_group g ON m.parent_id = g.idJOIN SPACEPERMISSIONS sp ON g.group_name = sp.PERMGROUPNAMEJOIN cwd_directory d on u.directory_id = d.idWHERE PERMTYPE='USECONFLUENCE' AND u.active = 'T' AND d.active = 'T'ORDER BY d.directory_name;

If you have an LDAP user directory you are familiar with the Confluence Admin\>User Directories page, where the connection to LDAP was configured.There is also a Confluence Internal user directory on that page.

I did not mean to imply that you had duplicate users in your LDAP user directory groups, rather that you could have a user in the Confluence Internal Directory which has the same user name as a user in the LDAP user directory. Because of aggregating group memberships across directories you may verify that the user is not in the group in the LDAP directory, yet that user may be getting permissions from group membership in the other user directory.

Please review the example scenario under [Managing Multiple Directories](https://confluence.atlassian.com/doc/managing-multiple-directories-229838494.html#ManagingMultipleDirectories-EffectofDirectoryOrder) (You have to expand the example.) I would paste it here for your convenience but it has graphics.

comments: author: Kevin Pelzman
body: yeah, this is what I get from the SQL query![2017-12-07 13_37_12-mRemoteNG - confCons.xml - COWSQL-4.png](https://community.atlassian.com/t5/image/serverpage/image-id/10618i513B12784FD41DF7/image-size/large?v=v2&px=999 "2017-12-07 13_37_12-mRemoteNG - confCons.xml - COWSQL-4.png")


author: AnnWorley
body: The article with the query warns:
> This SQL query may not return accurate results if you are using nested groups in LDAP or Crowd, or if you have users with duplicated usernames across multiple directories.

Could I trouble you to run this one to see if there are any duplicate users?

```
SELECT 
lower_user_name
FROM 
cwd_user
GROUP BY
lower_user_name
having count(lower_user_name) > 1;
```


author: Kevin Pelzman
body: Sure, this is what I get. This is my non-admin account that does not have access. I also had the local account under this name, but it is disabled and does not have access.

![2017-12-07 14_40_14-mRemoteNG - confCons.xml - COWSQL-4.png](https://community.atlassian.com/t5/image/serverpage/image-id/10624i93BCF41A3361FA1E/image-size/large?v=v2&px=999 "2017-12-07 14_40_14-mRemoteNG - confCons.xml - COWSQL-4.png")


author: AnnWorley
body: I just did some testing and it looks like aggregating group memberships apply even to disabled users.

Please attach a screen shot of the **kpelzman** user's View User page in User Management and a screen shot or shots that show the global permissions, from Confluence Admin \> Global Permissions.

Thanks for collecting all these materials and running the queries, etc.


author: Kevin Pelzman
body: I see what you are getting at. I removed the built in accounts from that user and it appears to be reporting correctly now.


author: AnnWorley
body: That's great to hear. Thanks so much for following up so the matter would not pester my mind, and for the sake of anyone else with a similar issue.


author: AnnWorley
body: Hi Kevin,

As so eloquently stated in [How to get a list of active users counting towards the Confluence license](https://confluence.atlassian.com/confkb/how-to-get-a-list-of-active-users-counting-towards-the-confluence-license-298978076.html):
> Confluence's license count is based on Global Permissions. Users will count towards the license in the following ways:
>
> If the user is a member of a group that has global permissions to use Confluence
>
> If the user is individually granted global permissions to use Confluence

The article linked above has SQL queries to find the users with permission to use Confluence. However, in your case, since you only have 10 or 11 users you could list them on the **Confluence Admin\>User Management** page using the **show all users** link, and see who the 11 are.

As part of the Confluence installation, a super user is created to administer Confluence. Is it possible that this is the 11th user? If so, it should show in the list.

I look forward to hearing what you find out.

Thanks,

Ann

comments: author: Kevin Pelzman
body: Yeah, the only problem is that I am pulling in all my users from LDAP, so I cant just look at the users page. Ill have to look the SQL way. As for the Global permissions, there are only 10 users with those permissions, and that is why I am so confused. It was working for a day or two, and then just stopped.

I thought about the super user as well, but, I disabled that account. (I know, it is not recommended).


author: AnnWorley
body: I understand you are pulling in more users from LDAP than you are granting Global can-use permission to. In that case, if you cannot chase down the extra user in the UI, the SQL queries should hopefully do the job. I hope you have time to update this thread to tell us how it turns out.


author: Kevin Pelzman
body: Ha! it shows 9 users (I removed one from one of the groups so that I was able to edit pages.

![2017-12-06 15_27_59-fdgdf - Infrastructure - City of Waukesha.png](https://community.atlassian.com/t5/image/serverpage/image-id/10539i007B5E52D5DC2B23/image-size/large?v=v2&px=999 "2017-12-06 15_27_59-fdgdf - Infrastructure - City of Waukesha.png")![2017-12-06 15_29_13-License Details - City of Waukesha.png](https://community.atlassian.com/t5/image/serverpage/image-id/10541i8EF92824F073D03F/image-size/large?v=v2&px=999 "2017-12-06 15_29_13-License Details - City of Waukesha.png")


author: AnnWorley
body: I am curious how you generated the list you posted.

I expected the results of the query to look something like this, so we could see what directory each licensed user is in:

![Screen Shot 2017-12-06 at 3.59.59 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/10542i1679B47E877718C7/image-dimensions/458x124?v=v2 "Screen Shot 2017-12-06 at 3.59.59 PM.png")

The list shows 9 users but the Licensed users field says 10. Because of aggregating group membership, you can remove a user from a group in one directory but it can retain membership in that group in another directory [Managing Multiple Directories](https://confluence.atlassian.com/doc/managing-multiple-directories-229838494.html#ManagingMultipleDirectories-EffectofDirectoryOrder):
> If the same username exists in more than one directory, the application will aggregate (combine) group membership from all directories where the username appears.

That means a user can be removed from a group in the LDAP user directory, but if the same username is in the Confluence Internal directory it could retain the membership there and be granted permission to use Confluence.

Please try the queries from [How to get a list of active users counting towards the Confluence license](https://confluence.atlassian.com/confkb/how-to-get-a-list-of-active-users-counting-towards-the-confluence-license-298978076.html). They aren't perfect but may give us a hint as to why we can't account for all your licensed users.


author: Kevin Pelzman
body: The output of the first screenshot was with using that querie from the link you posted. I do not have any of the users duplicated in any of the groups, so that cant be the problem. I have three groups that have access; they are shown in the screenshots.![2017-12-07 09_02_48-Group Members_ HelpDeskAdmins - City of Waukesha.png](https://community.atlassian.com/t5/image/serverpage/image-id/10595iCB37F017B9473B36/image-size/large?v=v2&px=999 "2017-12-07 09_02_48-Group Members_ HelpDeskAdmins - City of Waukesha.png")![2017-12-07 09_03_10-Group Members_ NetworkAdmins - City of Waukesha.png](https://community.atlassian.com/t5/image/serverpage/image-id/10596i4AB29532CE7475F9/image-size/large?v=v2&px=999 "2017-12-07 09_03_10-Group Members_ NetworkAdmins - City of Waukesha.png")![2017-12-07 09_03_29-Group Members_ DevOpsAdmins - City of Waukesha.png](https://community.atlassian.com/t5/image/serverpage/image-id/10597i8C2CE4A5D2A4C4E0/image-size/large?v=v2&px=999 "2017-12-07 09_03_29-Group Members_ DevOpsAdmins - City of Waukesha.png")