From ff7fb82ad047a24241ea50b02adb86618c3c837d Mon Sep 17 00:00:00 2001 From: "c1-dev-bot[bot]" <2740113+c1-dev-bot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 19:38:02 +0000 Subject: [PATCH] docs: document RBAC space roles and correct noun/verb defaults Add Space Roles and Space Role Assignments to the capabilities table (both opt-in). Add a new RBAC section explaining --use-rbac mode, the either/or relationship with granular permissions, and a troubleshooting note for the 404 error when RBAC endpoints are unavailable. Correct the noun/verb defaults section: the values shown in the C1 config form are suggested values only and do not determine the runtime defaults. When no nouns/verbs are explicitly configured, the connector syncs all available nouns and verbs. --- docs/connector.mdx | 38 ++++++++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/docs/connector.mdx b/docs/connector.mdx index 8df91395..c244e148 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -18,11 +18,30 @@ sidebarTitle: "Atlassian Confluence" | Groups | | | | Spaces | | | | Space permissions | | | +| Space Roles (opt-in) | | | +| Space Role Assignments (opt-in) | | | To limit sync times, a limited list of Spaces entitlements and their associated grants are synced. See the [Spaces entitlements synced by default](/baton/confluence#spaces-entitlements-synced-by-default) section of this page for more information. +## RBAC space roles + +The Confluence connector supports two modes for syncing space access: + +- **Granular space permissions** (default): Syncs individual noun-verb permission pairs (for example, `read-space`, `administer-space`) per space. This is the default behavior. +- **RBAC space roles**: Syncs Confluence's built-in space roles and their assignments instead of granular permissions. Enable this mode by setting the `--use-rbac` flag (or `BATON_USE_RBAC=true`). + +The connector uses one mode or the other — not both. When RBAC mode is enabled, granular space permissions are not synced, and the Space Roles and Space Role Assignments resource types become active. + + +**RBAC mode requires that Space Roles are enabled and entitled on your Confluence instance.** If the RBAC endpoints are unavailable (for example, because a trial or beta grant has expired), the connector's `Validate` step fails with the message: + +`RBAC data endpoints are unavailable (space-roles returned 404) — this can happen when a trial or beta grant for RBAC has expired` + +If you see this error, either disable `--use-rbac` or contact Atlassian to ensure Space Roles are enabled on your instance. + + ## Gather Confluence credentials Configuring the connector requires you to pass in credentials generated in Confluence. Gather these credentials before you move on. @@ -187,6 +206,9 @@ stringData: # Optional: include to skip syncing personal spaces and their permissions BATON_SKIP_PERSONAL_SPACES: true + + # Optional: include to use RBAC space roles instead of granular permissions + # BATON_USE_RBAC: true ``` See the connector's README or run `--help` to see all available configuration flags and environment variables. @@ -241,13 +263,13 @@ spec: ## Spaces entitlements synced by default -Each Confluence Space has its own set of permissions and allowed actions, which can result in a very large set of entitlement and grant access information in each Space. In order to reduce sync times, the Confluence connector only syncs a limited set of Spaces entitlements. - -By default, the Confluence connector syncs entitlements formed by valid pairs of the following targets (nouns) and operators (verbs), such as `administer-space` or `read-space`. +Each Confluence Space has its own set of permissions and allowed actions, which can result in a very large set of entitlement and grant access information in each Space. -Default targets (nouns): `space` +The Confluence connector syncs entitlements formed by valid pairs of targets (nouns) and operators (verbs), such as `administer-space` or `read-space`. -Default operators (verbs): `administer`, `create`, `delete`, `export`, `read`, `restrict_content` + +When configuring the connector in C1, the noun and verb fields are pre-filled with a suggested subset (`space` noun and 6 common verbs). These suggested values only pre-populate the configuration form — they are **not** automatically applied. If you leave the noun and verb fields empty (or do not set `--noun` / `--verb` flags), the connector syncs **all** available nouns and verbs listed below. + All available targets (nouns): @@ -270,6 +292,10 @@ All available operators (verbs): Not all target-operator (noun-verb) pairs are valid. -To change or limit what the Confluence connector syncs to C1, use the `--noun` and `--verb` flags when setting up the Confluence connector in self-hosted mode. See the [baton-confluence repo's README](https://github.com/conductorone/baton-confluence) for more information. +To limit what the Confluence connector syncs to C1, use the `--noun` and `--verb` flags when setting up the Confluence connector in self-hosted mode, or configure the noun and verb fields in the C1 UI for cloud-hosted connectors. See the [baton-confluence repo's README](https://github.com/conductorone/baton-confluence) for more information. + + +Space permission entitlements are only synced when RBAC mode is **disabled** (the default). When `--use-rbac` is enabled, the connector syncs Space Roles and Space Role Assignments instead. See [RBAC space roles](/baton/confluence#rbac-space-roles) for details. +