Problems accessing templates and moving/deleting pages after permission changes
Asked by Olaf Koester:

Hello,

I have some problems after changing some permissions on spaces.

I'd like to give some external users access to our confluence (6.5). So I've created a new space for them and also created a group (let's call it "group_1"). This space is used to work in collaboration with the externals.

I also created a group "group_2" for accessing internal spaces (there's a number of them). It's used by company members.

I gave these groups all the rights on each space as shown in the attachment.

![confluence-rights.JPG](/t5/image/serverpage/image-id/10033i239E83EC94C0BDDC/image-size/large?v=v2&px=999 "confluence-rights.JPG")

Myself has full rights on every space (confluence admin and also user). There are no page permissions set below.

On my personal space I did not change anything.

The default users group "confluence-users" was removed from each space because I do not want external users (which all belong to that group as also internal users do) to access any internal spaces via these permissions.

Since I did the changes described above, we're not able to access templates when creating a new page in one of the spaces (neither in "internal" nor in "external" spaces) and I'm also unable to delete pages in my personal space or any other space. (Mentioned again that at least I shoud since being confluence admin). It's also not possible to move pages to another location/space....

What's wrong here???

Who can help?

Regards

Olaf


Answers:
author: AnnWorley
body: Hi Olaf,

I understand that since you changed the permissions on some spaces, moving and deleting pages in those spaces and your home space is not working as expected and page templates are not available. Please let me know more:

* What happens when the users try to use a page template? Are they just not visible on the **...** menu? Or is there an error message?
* Is there anything in the atlassian-confluence.log (\<Confluence_home_dir\>/logs/atlassian-confluence.log) to give us a hint?
* Is there an error message in the browser when someone attempts to move or delete a page?
* Are you a member of the confluence-administrators group? I ask because space permissions don't impact members of this group (from [Confluence Admin Permission Levels Explained](https://confluence.atlassian.com/confkb/confluence-admin-permission-levels-explained-604209420.html)):

> The confluence-administrators group defines a set of "super users" who can access the Administration Console and perform site-wide administration. Members of this group can also see the content of all pages and spaces in the Confluence instance, regardless of space permissions.

Please try [Rebuilding the Ancestor Table](https://confluence.atlassian.com/doc/rebuilding-the-ancestor-table-153948.html) for the permissions and for the template issue, please try [Disabling or enabling all add-ons (using Safe Mode)](https://confluence.atlassian.com/upm/disabling-and-enabling-add-ons-273875716.html#Disablingandenablingadd-ons-Disablingorenablingalladd-ons(usingSafeMode)) to make sure that an add-on is not interfering.

I look forward to hearing more about the issue if rebuilding the ancestor table doesn't fix it.

Thanks,

Ann

comments: author: Olaf Koester
body: Hi Ann,

That's right. Since changing these permissions, I'm not able to delete or move pages and cannot use templates at all. Not space templates and also not global templates.

To your questions:

\* When trying to use templates (opening via "..." besides the create button), the window remains empty. Only the "wheel" is turning. No error message.

\* In the atlassion-confluence.log file I cannot see any errors regarding inaccessible pages. There's only this XSRF warning coming with _every_ try (and also when calling pages for viewing only).

2017-11-28 06:50:41,404 WARN \[http-nio-8090-exec-2\] \[common.security.jersey.XsrfResourceFilter\] passesAdditionalBrowserChecks Additional XSRF checks failed for request: <http://wiki.xxxxx.tld:443/rest/webResources/1.0/resources> , origin: null , referrer: <https://wiki.xxxx.tld/display/ID/IT+Dokumentation+XX+XXXXXX> , credentials in request: true , allowed via CORS: false  
-- referer: <https://wiki.xxxx.tld/display/ID/IT+Dokumentation+XX+XXXXXX> \| url: /rest/webResources/1.0/resources \| traceId: a0e1623b0821d54e \| userName: okoxxxer

\* There's absolutely no error message

\* Yes, I'm in the administrators group

I've tried to rebuild the ancestors table. That went VERY fast, less than a second I think. Looked like it was not really working, but there were no errors. And the database is small...

Also I emptied the cache as mentioned in the document. But that does not help at all.

But while messing around with that issue, I came around the problem:

It looks like I have a mistake in the configuration.

There's another thing I did:

Confluence is running behind a Apache based reverse proxy with SSL termination on the proxy.

To configure that, I also changed settings in server.xml (proxyName, proxyPort) but left secure="false" and scheme="http". That was because I am running http behind the proxy...

Now I turned back to start:

No proxy, access via VPN, changed back baseline URL...

And... problem solved! So, as far as I can say by now, there's a problem within my proxy/server.xml configuration and NOT a permissions problem...

Thanks Ann for helping on this (and open my eyes on configuration errors).

I will create another question on running confluence behind the proxy (regarding server.xml config).

With best regards

Olaf


Tags: permission

space

template