 | This plugin is not designed for and has not been tested against external user management systems. This is intended to extend and enhance the basic internal user management options that Confluence offers out of the box |
| Name | User Management Plugin |
|---|---|
| Vendor | Adaptavist.com Ltd (Website) |
| Authors | Dan Hardiker |
| Homepage | http://confluence.atlassian.com/display/CODEGEIST/User+Security+Management+Plugin |
| Issue Management | n/a |
| Categories | Admin Macros |
| Version | 1.0.2 |
| Availability | Confluence v2.7 to v2.10-m1 |
| State | Stable |
| Support |
|
| License | Freeware / Open Source (BSD) |
| Price | Donate |
| Release Docs | http://confluence.atlassian.com/display/CODEGEIST/User+Security+Management+Plugin |
| Java API Docs | n/a |
| Download Source | http://svn.atlassian.com/svn/public/contrib/confluence/user-management-plugin/tags/1.0.2/ |
| Download JAR | user-management-plugin-1.0.2.jar |
Quote from the Author
Dan Hardiker says:
My "let's hack Confluence up" plugin last year was Scriptix - this year it's the user management plugin, which attempts to do it's best to work around XWork/Seraph Interceptors not being pluggable. Well, it works – just about!
Enjoy.
Description/Features
An enhancement for the Confluence user management system, to prompt better security practices - including email verification and admin vetting of signups.
This has been a long awaited feature strongly desired by enterprises who want to be able to please their security guys without having to integrate the proof-of-concept Confluence roll out with their cumbersome external user management systems. The issue of spammers creating accounts where public signup is enabled has also come up several times in our experience, even with CAPTCHA on.
The main features of this plugin are (all independently configurable):
Better Password Control
- A raft of password strength/complexity options
- Password expiry (so you can make sure your users change their password every x days)
- Password history lists (so you can make sure your user's don't change to a password they've used in the last x)
- Password minimum change (so you can enforce a password change only once a day)
Account Locking
If a user enters their password incorrectly x times then they can be locked out of the system (their password is changed and they have to use the forgotten password functionality, or contact an admin).
Better Login
You can hide the "remember me" functionality (helps combat CSRF as well as malicious access while you are AFK) and disable browser auto-complete functionality on the login form.
End User Agreements
You can now please your legal department and display the desired "unauthorised access is prohibited and will be met with the full extent of the law" or "the content in this system is classified as level x" messages to your users during login and sign up.
Forgotten Password Restrictions
If you have a paranoid nature, then you may wish to disable the forgotten password systems for certain groups of users (e.g. administrators). After all, if someone's email client has been breached, you certainly don't want to give a hacker access simply by allowing a new password to be emailed out.
The list of groups can either be a white list or a black list (defaulting to the latter).
Sign-up Email Filtering
You can set a list of regular expressions to form either a white list or a black list (defaulting to the latter) of email addresses that can be used. This is very useful for either only allowing those with email addresses from areas you want to sign up, or for filtering out people using free email accounts - while still allowing public sign up with no manual intervention.
Sign-up Admin Approvals and Email Verification
This has been a long awaited feature request - you can now make users wait for an email to come in and to click the link in it, and have an Administrator approve the sign up request before the user is ever created.
Use can use both features together, or one without the other.
Sensible Defaults
When you first install the plugin, all the options are disabled and you must enable each feature you want. It also cleanly uninstalls returning your system to how it was if you wish to revert. This is to ensure that you can install it safely and uninstall it if you don't want it any more.
Usage
- Install via the plugin repository, or manually.
- Select "configure" against the plugin, or the "Adaptavist User Management" option in on the bottom of the Admin console left-hand menu (you may need to refresh the repository to see it).
The options should be self explanitory, but let me know if you're not sure what any of the controls do and I'll try to split them up a bit better.
There is a page where you can see the users waiting for approval.
Version History
| Version | Date | State | License | Price |
1.0-SNAPSHOT
(#1)
|
16 Apr 2008 | Stable | Freeware / Open Source (BSD) | Donate |
|
1.0.1
(#2)
|
25 Apr 2008 | Stable | Freeware / Open Source (BSD) | Donate |
|
1.0.2
(#3)
|
25 Apr 2008 | Stable | Freeware / Open Source (BSD) | Donate |
Screenshots
Screenshots |
|---|
| There are no images attached to this page |
Other Adaptavist Entries
Attachment Download Plugin
— Adds a servlet so you can download attachments from a page without needing to know the ID. |
|
Custom News
— An alternative to Confluence's blog posts macro to aid with customisation |
|
Developer Report Plugin
— Primarily as a proof of concept, this plugin shows what I've found you can do with FishEye plugins – hopefully this will help and encourage more developers to dive in and see what they can do. |
|
Insert Picture Plugin
— A in-place image management widget for Confluence to help with image attachment manipulation |
|
JIRA Visitor Plugin
— If you've ever found yourself commenting simultaneously as someone else with the same information, or been faced with the dreaded "workflow has already changed" message, or just thought "I wonder if anyone else is viewing this issue right now" - then this is for you. |
|
Plugin Message Client
— A library which when included as an extracted dependancy will allow java communication between the classloaders of the installed plugins |
|
Ranking Macro
— Yet another macro for voting/rating/ranking pages, this one is uniquely different to the others by providing a macro for ranking pages with a 'was this page useful' style approach, tracking only positive answers |
|
Statistical Analysis Plugin
— Confluence has lacked a cluster-ready, enterprise scaleable, remotely accessible statistically gathering and analysis plugin ... not any more! |
|
Synonym Plugin
— A search extractor for Confluence to inject synonyms for acronyms, words or phrases into the index to aid with searching |
|
User Security Management Plugin
— An enhancement for the Confluence user management system, to prompt better security practices - including email verification and admin vetting of signups |
Comments (17)
Apr 20
Dan Hardiker says:
Jon Nermut suggestedJon Nermut suggested:
Apr 20
Stephan Janssen says:
Your email address has been successfully validated. Your user is now approved...Is displayed on a themed confluence page. It would be nice if "proceed to login" would actually be a link to the login page ! Thanks in advance
Apr 22
Dan Hardiker says:
This is done in v1.0.1This is done in v1.0.1
Apr 20
Stephan Janssen says:
BTW It seems to work on Confluence 2.5.4 as well !BTW - It seems to work on Confluence 2.5.4 as well !
Apr 20
Dan Hardiker says:
Excellent, I'll modify the repository metadata next time I'm editing it.Excellent, I'll modify the repository metadata next time I'm editing it.
Apr 20
Stephan Janssen says:
When I click on the email to confirm the email notification and log in with the ...When I click on the email to confirm the email notification and log in with the new user, I get the following error :
The following error(s) occurred:
However the user is logged in correctly...
Apr 20
Stephan Janssen says:
The HTML title for the login page is incorrect and shows the fully qualified plu...The HTML title for the login page is incorrect and shows the fully qualified plugin name instead.
Apr 22
Dan Hardiker says:
Fixed in 1.0.1.Fixed in 1.0.1.
Jun 09
Bruno Duarte says:
Does the "Signup Email Filtering" filter by repeated mail address? I.e, reject m...Does the "Sign-up Email Filtering" filter by repeated mail address? I.e, reject mail address if already exists a registered user with that address..
Jun 11
Dan Hardiker says:
No, but this is a feature that I'm resolving in a separate plugin (we need it as...No, but this is a feature that I'm resolving in a separate plugin (we need it as we have 2x JIRA and 1x Confluence systems all Crowded together, and we need to ensure that they only sign up one per email address).
Jul 02
Robert Manna says:
Maybe I'm just being an idiot, but how do I get the email filter to work correct...Maybe I'm just being an idiot, but how do I get the e-mail filter to work correctly? I suspect I'm screwing up the sytax of the regular expression. Since I'm not a programmer that may have something to do with it. What is the sytax I should use? Also, I want to only accept e-mail addresses from a specific domain, and exclude all others.
Thanks,
-R
Aug 20
martin says:
i also have the problem with the email filter. Do we have to use regexpression ?...i also have the problem with the email filter. Do we have to use reg-expression ?
I have tried, but it didnt work.
Can somebody give us examples ??
THANK YOU
Martin
Jul 03
Jeff Wilbert says:
Awesome plugin! thanks! A few requests Hopefully easy Ability to edit added r...Awesome plugin! thanks!
A few requests – Hopefully easy
Possible bugs
Again – awesome plugin, thanks!
Aug 26
Bruce Michelsen says:
Assigning groups to an account right after giving admin admin approval is a grea...Assigning groups to an account right after giving admin admin approval is a great idea.
Aug 26
Bruce Michelsen says:
Is it possible to have a notification sent to an email address so the administra...Is it possible to have a notification sent to an email address so the administrator knows there are accounts awaiting approval?
Aug 28
Bruce Michelsen says:
Info The Admin Approved (needs email validation) Email is sent when the adminis...Info
Bugs
Sep 01
Eric Dalquist says:
I'm not sure if there is a better place to report issues. I just tried this plug...I'm not sure if there is a better place to report issues. I just tried this plugin on a Confluence 2.9 install that uses Crowd for external auth and I get the following error message when trying create a new account. I only have email verification and admin approval turned on: