disabled profile still can access to the website

[Selcuk Savas]

Hi,

I have disabled a profile couple of days ago but when I run daily login report I can see that the profile is used this morning.

Does anyone know how it can happen? How can I stop it?

Cheers,

Selcuk

[Septa Cahyadiputra · Accepted solution]

Hi Selcuk,

You might want to double check if the user in questioned used "Remember Me" feature as this issue might occurred if that is the case. Confluence keep the token alive and mistakenly thought the user is still online before it logged the user out.

Please note that this is just a theory which I haven't try to reproduce yet.

Hope it helps.

Cheers,
Septa Cahyadiputra

[Selcuk Savas]

Hi Septa,

Thanks for the comment. I actually don't know. Even though the token has been kept alive, the user need to click login button to login (as I do - I set rememeber me as well) and in this case the system should not allow the user login as the profile is disabled.

I will test this theory and let you know.

Cheers,

Selcuk

[Selcuk Savas]

Hi Septa,

You were right.

I logged in with a newly created dummy account with our standard access groups settings.

I ticked rememeber me and then closed the session.

I went the admin area and disabled the account.

I re-opened the website and I logged in successfully but I cannot see any pages as due to the access group settings.

I will update my support ticket. It may cause some sucity issue for all Confluence users.

Thanks for pointing that out.

Cheers,

Selcuk

[Selcuk Savas]

Hi Septa et al,

Atlassiaon support helped me to sort this issue out.

It is a bug actually but somehow it has been fixed with latest version.

We are on 4.1.4.

Cheers,

Selcuk

[Selcuk Savas]

Thanks Rian. Will do.

We have only one (default) directory managed in Confluence.

No external connection etc.

The odd thing I tried to login with it and it did not let me in. But somehow last successful login shows todays date.

Cheers,

Selcuk

[RianA]

That's looks unusual. May I know how many user directory that you have? Also, can you please double check to see if that user exists on multiple directories? I would suggest to raise a support ticket at https://support.atlassian.com to further investigate this issue.