How are SharePoint user permissions applied in Confluence Server/DC?
- Dorrit Riemenschneider-Denecke
- Frank Schreiber
- Almuth Boehme [Communardo]
- Andi Muka
As a rule of thumb, only users who have direct access to information in SharePoint will have access to it when the information is embedded in Confluence.
Technical Details
For authorization within the app the user directories of SharePoint and Confluence (for example Active Directory, LDAP) are not directly used. That means user names, user SID etc. don’t matter. Instead, authorization takes place via so-called access tokens which are stored in the browser session.
For authentication against SharePoint the SharePoint user directory is used. Following the (simplified) process of authentication and authorization is described:
When the user logs in to SharePoint a user token is created for this user.
The user token (together with some additionally required information) is then used to request an access token from SharePoint. Thus the access token is issued for this specific user.
The access token is then used for every request of data from the Confluence macro to SharePoint. That means that the response contains only SharePoint data that the logged in user is allowed to access.
How user permissions affect Confluence Macros
The user has to be logged in to both systems (Confluence and SharePoint) in one browser window while using the app.
User not logged in to SharePoint
If a user is logged in to Confluence but not to SharePoint he won’t see any SharePoint content. Instead a message like the following will be displayed:
Image 1: User not logged in to SharePoint cannot see any SharePoint content
User logged in to Confluence and SharePoint
If a user is logged in to both Confluence and SharePoint, then the SharePoint List macro or SharePoint Document macro in Confluence will only display lists and documents the logged in SharePoint user is permitted to see in SharePoint itself.
Especially for a document library where the logged in SharePoint user has only access to some (but not all) files respectively folders: In this case the SharePoint List macro will also only display these files respectively folders.
User logged in without permission
If a SharePoint List macro is configured to show a list that the the logged in SharePoint user isn’t allowed to see, the following hint will be displayed:
Image 2: Logged in SharePoint User can only see authorized SharePoint lists
Likewise for the SharePoint Document macro:
Image 3: Logged in SharePoint User can only see authorized SharePoint documents