Why is users removed automatically from user groups?
Asked by Leif Nerheim:

I have created a user group in Confluence servers. Have added some 50-ish users to the group. But users are automatically removed from the group - by the user "Anonymous".  

Seems like it's happening random and automatically?


Answers:
author: Nic Brough -Adaptavist-
body: How exactly do you know that the group is being modified by "anonymous"?

What user directory system are you using?

comments: author: Leif Nerheim
body: Hi Nic!

I see it in the Audit log. I was wondering why users I added one day was gone the next:-)


author: Nic Brough -Adaptavist-
body: Anonymous users cannot be given admin rights, so it was not a human doing this.

Most likely explanation is that the groups have been modified in your external directory system.


author: Leif Nerheim
body: We are using the app "SAML Single Sign On for Confluence". No problems with access to Confluence, but when adding to a group in Confluence, som users seems to be automatically removed by "Anonymus". I've created that group in order to restrict a page.   
The problem occurs on pretty much the same few (5'ish) users. I'm adding - and Anonymus is removing?


author: Nic Brough -Adaptavist-
body: Ok, I think we are both drifting around the problem and looking at "maybe" before we've focussed on the core of it. I would like to go back to the basics and establish that I understand enough about your setup to be sure I'm looking at the right part.

To do that, can you tell us:

1. What user directory, or directories, you are using. Go to Admin -\> User directories and show us what the list of directories is (feel free to obscure server/domain names etc, we are only interested in the technical details - the type, last sync, filters, order and so-on)

2. Where you are getting the reports of "Anonymous removed User X from groupY" from?


author: Leif Nerheim
body: 1) Confluence Internal Directory

Katalognavn Type Rekkef?lge Operasjoner

Confluence Internal Directory Intern

2) Audit logs

21. des. 2021, 09:01:00 CET Anonymous Users and groups User removed from group lederne *"userid"*


author: Nic Brough -Adaptavist-
body: Ok, great, that really narrows it down. I was suspecting you might have an external directory and changes there would be recorded as "anonymous" in the audit logs, but that's not the case here.

In the audit logs, anonymous means "it was not done by a human logging in and clicking things" or even "it was not a human running a REST call to do it", it was a system call.

You have a service, or script, or app, that is changing the user groups for some reason. Start with a quick look at "manage apps" - are there any in there that might be doing user management? Then look at the lists of services and listeners you have running.


author: Leif Nerheim
body: Hi!

Thanks for your guiding and tips to resolve the problem.

Haven't found any apps that are doing user mngmnt.

Off for christmas holiday now - looking into it again in 2022:-)


author: Pramodh M
body: Hi [@Leif Nerheim](/t5/user/viewprofilepage/user-id/4315544)

Your site may have anonymous user access, please check the global permissions and default space permissions to troubleshoot the access.

You may also audit the cause of the issue in logs and by tracking the user sessions.

Thanks,  
Pramodh

comments: author: Leif Nerheim
body: Hi Pramodh,

Yes, I see in the global permissions that "Anonym" are allowed tu use Confluence - with anonym access.

But I thought this user also was involved in creating new users based on our SAML/SSO connection?

What is the consequnse of turning Anonym off?


author: Nic Brough -Adaptavist-
body: It means people who have not logged in will not be able to see any pages.


author: Leif Nerheim
body: I have changed the "Anonym acces" setting to "can not use Confluence" on the Global acces page - but the problem continues - Anonym still removes users from the group


Tags: confluence-server

server