Guest users and guidance on development

[marc]

Are there any updates on external collaborators or guest users?

We are trying to enable our app to work with guest users, but we lack guidance.

For example, the rest API for GET /wiki/rest/api/user returns both:

"isExternalCollaborator": true,
 "externalCollaborator": true,

as per the documentation at https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-users/#api-wiki-rest-api-user-get . What is the difference in these fields?

[marc]

Hi @MorganWang ,

Can you check the current state of guest users? In your earlier post
you wrote:

@MorganWang

It is critical that all apps are applying the correct authorisation checks to ensure permissions are enforced (as per our security requirements ). Please review and ensure your apps implement the correct guidelines for Atlassian Connect apps and Forge apps .
We will be following up shortly with a guide on how to identify and manage guest users, and details of how to opt-out if you elect to.

Guest users are now in GA, but app developers lack the tools to apply the security requirements you mandate!

cc @tpettersen

[marc]

Hi @NidhiRaj ,
After your announcement of guest users and the current rollout we see that guest users have a new permission model.
It seems addons have no access to guest user user properties, or guest users do not have user properties (see https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-user-properties/#api-wiki-rest-api-user-userid-property-key-get ).
Can you advise on how addons need to handle this situation?