External Authentication Intermittently does not work.

[mvoogt]

I'm having an issue with external authentication lately. I'm running FMS 13.0.10.1004 on OSX 10.9.4.

Intermittently external authentication seems to not let users in to the database. The server doing the authenticating is sitting right next to the filemaker server. Both on the same network. When I go to System Pref. > Users & Groups on the filemaker server, the network account server is green and appears to be connected.

I then do various things in FMS, turn the database server off/on, Go to Database Server > Security > Client Authentication and toggle the accounts dropdown from "FM and External" to "FM Accounts Only" and back again...THEN everyone seems to be able to get back in.

Any idea what my issue is?

[Wim Decorte]

What happens when a user tries to log in: they get prompted a few times and eventually it goes through?  Or it always fails?

Are all clients Mac?  If so what versions?  Are the failures limited to some clients / some OSes?

[mvoogt]

They are prompted for a user name and password however it seems to always fail. Non-External Auth accounts (FM accounts) work fine. All are mac clients, most on FM Pro 13, some on 14. I'm not sure if it is all users, however it is more than one user.

[Fitch]

There's a Windows bug where external auth fails unless you have the "Allow Credential Manager to save password" checkbox selected in the File Options. Wasn't aware of an issue with Macs but might be worth a look.

[Steven H. Blackwell]

The Credentials Manager issue is Windows OS only and deals not with External Server Authentication but with Single SignOn if I recall correctly. Thus, that is not the issue here, especially since your Server is on Macintosh OD.  It is FileMaker Pro 14 only as well. So if you have failures from any client except FileMaker Pro 14 on Windows OS, then something else is likely happening.  And that was the reason for Wim's questions.

 

Double check the Macintosh clients to see that they do not have incorrect or out-of-date credentials stored in their KeyChains for these files. If they do, you'll have authentication issues.  Remember there is no SSO on Macintosh.

Steven

[mvoogt]

Thanks Steven,

It happens on my client machine as well so I don't think it is client specific. Very odd, deleting credentials doesn't seem to do anything. It just doesn't authenticate. I'll wait a few minutes (sometime much longer) and then I will be able to get in without changing anything on the server.

[Wim Decorte]

15 hours ago, Steven H. Blackwell said:

The Credentials Manager issue is Windows OS only and deals not with External Server Authentication but with Single SignOn if I recall correctly.

That is correct.  The issue prevents SSO from working but EA still works.

14 hours ago, mvoogt said:

Thanks Steven,

It happens on my client machine as well so I don't think it is client specific. Very odd, deleting credentials doesn't seem to do anything. It just doesn't authenticate. I'll wait a few minutes (sometime much longer) and then I will be able to get in without changing anything on the server.

Sounds very much like the directory service machine goes to sleep and does not wake up in time to respond to the first request before FMS times out, but once woken up it does respond to the second request in time.  Double-check all power saving settings...