When a user signs up to a Confluence instance that has domain restricted sign up enabled, they are normally created as disabled users and are unable to login. However, when the underlying user directory does not support disabling users, such as ApacheDS 1.5, then the user ends up being created as enabled, due to CWD-3949
Whilst the user is able to login, they are still unable to user confluence, because they are not added to the right groups.
h4. Steps to reproduce: Start a Confluence instance Configure a mail server Configure it to use ApacheDS as it's primary directory Enable domain restricted sign up Sign up on the login form Try to login as that user - you are logged in but cannot user confluence. You should not be able to login at all. * Alternatively, login as an administrator and go to the newly signed up user's profile. The user should be disabled but they are not.