Can not modify group membership failed

[Richard Scorgie]

I'm experiencing some strange behaviour when trying to use the AD connection.

In the user directories page i see the following error message just below the sync button.

Last synchronised at 11/15/11 5:56 PM (took 22s). "

Synchronisation failed. See server logs for details."

However i can find the users when i search for users i the manage users page. But when i try to add a user to a group i get the following error:

"The following error(s) occurred:
cannot.modify.group.membership.failed"

Anyone have any ideas? I've looked at the catalina.out log file but i cant find any errors there. Which other log files are there where i can see details about this error?

[Sander Brienen [Avisi] · Accepted solution]

In your User Directory config for AD, did you set your LDAP permissions to read/write? If the permissions are set to read-only, you cannot add users to a group from within Confluence.

Also another tip: If your confluence users are not in the group named confluence-users in AD and you do not want to configure each space individually to add the correct AD group for users to have access, use the option "Read Only, with Local Groups". This will move any user, logging in into Confluence, to be copied automatically to confluence-users in de Confluence internal directory. This is especially handy when you want to create a new space and not add your AD group to every space.

[Richard Scorgie]

Thanks for the help.

If I understand this correctly then if I set up the LDAP Permissions in COnfluence to Read Only with Local Groups, and add 'confluence-users' to the Default Group Memberships Field then users will automatically be added to that group.

[Sander Brienen [Avisi]]

Yes. On first login, the user info is copied from AD to the Confluence User Directory. See it as a local cache. The default group membership indicates to what group this user is copied.