Permissions

Permissions is used to add rights to the needed users and groups.

Space admins can control the permissions of groups and individuals who can view and edit the space.

• Anonymous access means also search engines like google
• confluence-users is all logged in users (Haka and non-haka who have accounts)
• @csc.fi and similar domain groups include all users of said domain by email.
  • Domain groups do not propagate from #-groups, they need to be defined in the wiki space permissions to be effective

https://confluence.atlassian.com/doc/space-permissions-overview-139521.html

Permissions are "global" in the space context, aka. they are the same for each subpage, and need to cover all needed access rights for the space.

• Alternatively, you can request to set up different spaces for external and internal use.

Common access should be controlled from Space Tools -> Permissions

Restrictions

Restrictions can be used to limit the existing access given in permissions mentioned above.

Restrictions should not be used if not absolutely necessary. And if they are used, preferred way is to restrict a group and add macro "User list" (Reporting category) on the root of the restricted tree to list the people who have been allowed access to the restricted section.

1. Group changes propagate everywhere the group is used. In worst case, every page that has been restricted on a user basis, needs to be updated manually whenever a new user needs access or an old one doesn't anymore.
2. If the page looks just fine to you, but someone else cannot access it due to restrictions, even if they can access other pages of the site, debugging restrictions is time-consuming, unnecessary work, which can be avoided by listing the group memberships for all group members with access, at the root of the restricted page tree.
   1. Use macro "User List" under Reporting category for this
3. Group syntax in eduuni wiki needs the whole url path. Example: https://tt.eduuni.fi/groups/csc#cscedbestpractices-members 

The lock icon near the page title is misleading in the sense that it does not show the permissions that control the actual access to the space.

View restriction is in most cases enough. View is inherited to sub-pages and contains both view+edit permissions.

Edit restriction does not inherit to subpages and restricts editing from anyone but the listed group/user.

Restrictions are an additional limitation to page access. The group should have normal space permissions access to be able to enter.

Misleading button

The page title in confluence has a misleading button that typically says "Unrestricted" in the tooltip. This means restrictions, not the actual state of the space permissions.

As stated above, permissions determine the access rights, restrictions only constrain the existing rights further.