How can we manage read only users and permissions?

[Tim Mohrbach]

Hi,

we are close to changing from our old wiki software to confluence. It's a powerful tool, but we have one major blocker and would like if there is any way around it.

We have some knowledge we need to share among a few hundred users. But it is too highly confidential to share it with anyone on the web.

Means one space requires us to create something like 300 read only users (not authors). But that would require a really big license fee, where we are actually only 8 people editing pages and spaces.

Is there anyway to achieve user logins for read only users for certain spaces without buying the huge license for a few hundred authors?

Thank you and best regards

Tim

[Nic Brough -Adaptavist- · Accepted solution]

In order to know what access someone should have, Confluence needs to know who they are.   So they need an account to log into.

Unless you enable "anonymous" (never for any access other than read, of course, or you can't track the activity). 

What you need is the ability to authenticate people, but not identify them.  So that anonymous access can work for authenticated users without them logging in.  There's no way Confluence can do that, so your instinct to reach for something else is spot-on.

I have done this before a few times by using certificates in the Apache front-end.  You give every user (readers and editors) a certificate and that has to be presented before Apache will let them get to Confluence.  Editors then log in as normal to get their edit rights (unless you get a bit more sneaky and replace the Confluence login with something that reads the certificate and pulls out their used account from data embedded in it).

I've not worked with Tomcat Realms, but it does sound like another good way to do it.

[Tim Mohrbach]

tomcat realms with basic authentication and digested passwords was the way to go... I can scale this as far as I like and have full control over who can use the anonymous user to read.

[Tim Mohrbach]

Could the tomcat realms be a possibility to achieve this actually?