Confluence session persistence after external directory account disablement

Question

Goal: Bound the window in which a disabled or expired external directory account can still access Confluence, so directory least-privilege state is enforced sooner than the default session lifetime.
In self-managed Confluence Server or Data Center connected to LDAP or Active Directory, Confluence maintains its own session state after login and does not revalidate directory credentials on every request. Existing sessions and Remember Me cookies can remain valid after account disablement or password expiry until session timeout, cookie expiry, or cluster cache eviction. Confluence global and space permissions are stored independently and are not automatically removed when the directory account changes. Revocation timing varies by version, directory connector, and cache configuration.
Which Confluence setting or supported extension forces revalidation of external directory account status at a defined interval? Can session invalidation be triggered immediately when directory credentials expire or an account is disabled? What is the maximum access window imposed by session timeout and Remember Me settings in this scenario?

Siddharth · Answer

Short answer
No standard Confluence setting forces periodic revalidation of an external LDAP or Active Directory account after login, and Confluence does not natively invalidate an existing session immediately when a directory account is disabled or a password expires. After authentication, Confluence enforces access through its own session and independently stored permissions; directory account status is not checked on every request.

Confirmed behavior

Confluence authenticates against LDAP or Active Directory at login, then maintains its own session state.
Global and space permissions are stored separately from directory account status, so disabling an account does not remove Confluence permissions or end active sessions.
Remember Me cookies can extend access beyond the normal session lifetime.
In Confluence Data Center, session or cache state may replicate across nodes, so invalidation on one node is not necessarily immediate cluster-wide.

Maximum access window
The window is effectively the greater of the configured Confluence session timeout and the Remember Me cookie lifetime, plus any cluster cache replication or eviction delay in Data Center. Exact default values vary by Confluence version and configuration and must be checked on the target system rather than assumed.

Steps for this case

Review Confluence General Configuration and confluence.cfg.xml for the configured session timeout and whether Remember Me is enabled.
In a non-production environment, disable a test LDAP/AD account, log in, and measure how long the session and Remember Me cookie continue to grant access.
If using Data Center, repeat the check on multiple nodes to observe propagation delay before session invalidation takes effect everywhere.
To narrow the window, shorten the session timeout and disable Remember Me, understanding this affects all users and increases directory authentication traffic.
For faster revocation, manually invalidate sessions or clear cluster caches, and consider SSO with conditional access if immediate enforcement is required.

None of these mitigations guarantees immediate revocation solely from directory disablement. Manual invalidation may not remove already-issued Remember Me cookies until they expire.

Missing diagnostic detail
Is this deployment a single Confluence Server instance or a clustered Confluence Data Center installation? This determines whether session invalidation must be propagated across nodes.

Confluence session persistence after external directory account disablement

1 answer

Short answer

Confirmed behavior

Maximum access window

Steps for this case

Missing diagnostic detail

Your perspective belongs here.

0 question comments