oAuth and External Server Authentication

New question for me but sure this is an old topic. FMS 2025 on Windows Server External Authentication MS Entra ID (AD). Users are members in multiple groups A, B, C. FMP file has matching accounts and privileges sets (PS) with different levels of access per PS. When user authenticates is there a list (a, b ) of the member's groups passed to FMP? if so, what function returns? I understand FMP will authenticate to highest sorted order in the PS list, next question...what is best practice for user to switch to additional account/PS? Trying to avoid managing user level AD in FMP. Thanks in advance.

Hi, I'm trying to obtain or refresh a Google Cloud OAuth 2.0 Access Token using a Service Account Key and FileMaker native Base64Encode. Dependencies: Service Account JSON key from the secure container field. Using FileMaker's native TextDecode function to interpret the container data as UTF-8 text. I'm out of ideas on what could be causing the fail. Anyone care to pitch in with ideas? All the very best, Daniel

(using FM Server v21.1.1.40, FMP client v21.1.1.41) This is a head scratcher: My boss can log into all but one of our databases using External Server and FileMaker File (the two types in the Authentication window), but he can't log in via External Server in a relatively newly created FMP file; he can log in using FileMaker File. His credentials haven't changed, and he has no saved passwords in Keychain (on his MacBook). The error message he gets is "The provided account name and password cannot be used to access this file." The file is suspect, but its permissions setup is the same as in all the other databases so I'm at a loss where to go with this. Any ideas o…

Dear Members, Today our program is able to provide access with one Active Directory security group and one privilege set in FileMaker for one dedicated department users (we will call it Dept A) Everything is working fine. In the next future, we would like to allow new departement users (Dept using the same method BUT from another Active Directory. Do you know how or can you confirm if FMServer is able to allow two different security groups (with two different group names) from two different Active Directory to connect on a FileMaker DB? Thank you for the help.

Hi, I have done integrations with Microsoft APIs and others but Google seems a bit different and I'm stuck on the last part. I need to get a token to access the calendar API. I believe I set everything up as required (I have a service account and defined scopes) and I got a JSON file from Google that contains the 'client_id ' and a 'private_key'. The end points are also provided: "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token" What would be the next step? I get the notion that I need to create a JWT key but when I enter the data I have in jwt.io it says invalid signature (do I …

Hello! We've been using external authentication custom Oauth with Okta for the better part of the year with no issues with our FM windows clients, but have not been able to authenticate on MacOS. When opening the FM file, regardless of FM version, no option for external authentication is displayed, only the Account Name and Password sign in fields are displayed. Originally I thought this was a limitation of FM software on MacOS, but I cannot find any documentation confirming this. Windows clients are accessing the same file with no issues, and under File Options, "Show sign-in fields even when OAuth or AD FS is enabled" remains checked because we still have a fe…

What is the user experience, when an iPhone user is accessing a database via Okta, and their FM account is set up to re-authenticate after 10 minutes? Does the iPhone user re-authenticate via Okta after each time that they are idle? Thank you in advance!

I'm running a Filemaker Server 19.2 server behind a Cisco Firewall, and we're having problems with MS AD authentication being rejected. We had it working for a while, but then it seems to have stopped working. I'm trying to locate a definitive guide to what firewall ports need to be opened to which IP number(s) / range(s). Some online documentation I read seemed to indicate that Microsoft's Azure servers need to connect directly to Filemaker Server, but this seemed to be wrong, as we could see it was the workstation PC that was requesting through Filemaker Server via port 443 (https) at the point when authentication was attempted, when we had it working OK earlier. …

We have successfully implemented OAuth integration into a couple of our FileMaker servers with our custom IdP. We're now hoping to implement it on server in a heavily restricted network. We have allowed traffic in and out on 443 between the FileMaker server IP to our IdP IP, but we can't get a successful verification of our custom IdP. When clicking the Verify Your Identity Provider, we are sent to our IdP to authenticate and then after a successful login and releasing the information, the browser spins for 120 seconds, then the browser URL switches to a local FileMaker server address and sits for another 30 seconds before reporting failure saying the access token or I…

Hi there we're currently switching from FM Server 16 to FM Server 19.5.4.400 and facing the issue that our LDAP authentication from FM Server 16 is not supported any more. Thus we decided to setup a keycloak server using serveral tutorials on the net... A big thanks to all the authors! We used https://www.soundsessential.com/blog/204-setting-up-a-keycloak-server-for-authenticating-to-filemaker-introduction and We learned a lot on the way but now we're stock. The current setup is two separate container one running filemaker on ubuntu 20.04 and a second one (on another host) running keycloak. Both server use a wildcard ssl certificate from our domain…

Hi! I configured my custom oauth provider in my Filemaker server 19.4.2.20. Every is fine except I can't access database when my external authentication is activated. I only can access to databases through my new custom OAuth provider login page and not with my internal accounts (default FMS login form). Is there a way to do so ? And I can't even not login with my internal admin account. So, I can't configure the databases for using my own provider. And, is it possible to activate external authentication only on some databases on this server, not all? Thanks a lot, Tomy

Hi all, I am not very familiar with External Server Authentication works when a user belongs to more than one group in the Windows Server Active Directory. Need guidance and help to address the issue below. Let us say that I have two user groups in Windows Active Directory: GroupA and GroupB and a FileMaker Solution named FMProj has Three layouts (i.e., Layout01, Laypout02 and Laypout03). (1) Users of GroupA can access Layout01. (2) Users of GroupB can access Layout01 and Layout03 using the if condition in the script (i.e., get(AccountGroup) ="GroupB"). User Jan.Doe is a member of both GroupA and GroupB and we want her to be able to accesss Layou…

Hi, we are running FileMaker Server 19.4.2.204 on Windows 2012 R2 and are having problems authorizing our instance against our university's in-house OAuth IdP. We've been able to get individual users authorized but are having no success getting authorization for groups. By visiting https://<Authorization Code Endpoint>?response_type=code&client_id=<Client ID>&state=your_opaque_state&redirect_uri=https://<server>/oauth/redirect we've been redirected to a page that includes a session code. Using that code, together with the Client ID, Client Secret, Authorization Token Endpoint can curl an access token. The decoded JWT id_token returned…

I am running into an issue with SSO using FileMaker server 19. for certain group users. The FileMaker server is hosted through VM using Microsoft Windows Server 2106 DataCenter. I have setup three user groups with different privilege's set. The groups have been setup part of security group within my organization. The behavior I am seeing is that, it is always the first group list on the priority list under the Manage Security tab are allowed to login, while other users at lower priority can not log in? FileMaker log error shows the following: 2022-02-03 13:08:25.374 -0600 Information 730 vm-001 SECURITY: Client "(NXL) [10.xx.xx.xx]" single sign-…

Hi It's my first message here, generally I post in French on fmsource.com but nobody has any experience on this subject. Until now, I have a server on MacOS and I use a LDAP on a Synology for the authentification. Now I want to migrate (when the final version will be there) to the new version on Centos. First I tried to connect the server on LDAP with no success. So I searched an other way and find the white paper about other OAuth provider https://www.soliantconsulting.com/blog/oauth-providers-filemaker-apps/ I chose Auth0.com because they have a free offer up to 7000 users and it is easily synchronizable with my ldap server. But the white paper…

If you need to use keycloak in a Joyent SmartOS zone I wrote down my own notes on gist: https://gist.github.com/TyrfingMjolnir/d99226078f76cd4760114ff223fbc702 I use Joyent SmartOS for virtualizing unix, linux, BSD, and others. A Joyent SmartOS zone is very similar in use case to docker.

Following the instructions in oauth-extensibility-addendum3 (excellent document! - big thank you to the authors) I have (almost) succeeded in getting it up and running on a local machine. This is of course for dev and test only. My setup is: MacOSX 10.15.7 (running on a MacBookPro 2,6 GHz 6-Core Intel Core i7) Keycloak 11.0.2 running in Docker 2.4.0.0 FilemakerServer / FilemakerPro 19.0.1 To make this all work on https://localhost a certificate is required which you cannot get from a CP. Conveniently, installing Keycloak in Docker with docker run -p 8443:8443 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=password quay.io/keycloak/keycloak:11.0.…

After moving to Windows server I can't Authenticate with Display Name (First name Lastname) I have to use the User logon name. I have a lot of places where I use Get ( AccountName ) in my solution. I could map the name but prefer changing login. Is it possible to use the Display Name on windows server to login with? Regards Frank

Trying to setup Auth0 on windows server - @Wim Decorte do you have any guidance?

Hi all We've been following these guides and are now successfully communicating with our Office365 calendars: https://dbservices.com/articles/filemaker-outlook-calendar-integration/ https://www.soliantconsulting.com/blog/microsoft-graph-api-filemaker-one/ The app that we have registered in Azure AD is the same as the one we use to authentica/authorise users when they first log in to our FileMaker database. My question is whether, instead of the user authenticating via the webviewer in order to get the tokens for accessing calendars, they can't use the token that was presumably retrieved/used on the initial logon in to the database. Thanks…

We host FileMaker Server 16 and have around 20-25 users connecting to it using FMPro 16 plus a couple of WebDirect users. Currently the security structure is quite flat and which is obviously not ideal and upcoming changes in the business mean a more hierarchal structure is becoming critical. I have been working on how to implement this on-and-off for a couple of months now testing various techniques which integrate into our other business systems but have hit a few brick walls. Desire to Integrate with other systems’ user accounts (OS, email, etc) and several FileMaker databases made me go down the external authentication route as opposed to internal authentica…

We're about to migrate our filemaker server to the cloud, and have it open, so it can be reached by any public IP. We will switch to external authentication via Azure AD for all our users, which I understand will allow us to use MFA. However, aside from the externally authenticated users, there will be the one admin user within our database, which is of the usual 'filemaker user' type. Is it not possible that this could be subject to a brute force password attack? Would the workaround be to remove this user and have an externally authenticated admin user? Is this safe? Thanks

Hello All, I've a peculiar issue regarding external authentication using UPN. We are serving our particular project on WebDirect. Filemaker Server 18 We have two companies, CoA and CoB CoA has one forest/one domain, but multiple UPN suffixes for different sub-companies: CoA1, CoA2 CoB has one forest/one domain, single UPN suffix Two-way trust established and working well as Users are able to login with CoA UPN and Users are able to login with CoB UPN The problem starts when a user from CoA1 tries to login - It won't authenticate and an error is given saying that they don't have access. If the user only uses the SAMAccount na…

UPDATE: A user claimed to have been clicking a checkbox, which has a script trigger to run a script. The script wasn't executing at times. I misdiagnosed the problem. Sorry for the trouble (I see no way to delete my post here). ORIGINAL POST: I have a database using external authentication (via Active Directory). FileMaker Server 17. Scripting using Get(AccountName) (using some logic ("if") based on an expectation of a particular AD account name, and other functionality) works fine in FileMaker Pro 16 Advanced (returning a value like "smith"; the user's AD account name), but lately, the script isn't executing as expected *at times*, when using WebDirect. I …

CLIENT: macOS 10.13.6 FileMaker Pro Advanced 16.0.5.500 SERVER: Windows Server 2012 RS FileMaker Server v.17 I an external authentication account in the form of an AD account: "ken", FM group: "ken_group" [full access]. I also have a FileMaker File account "ken" with [full access], and it is lower in the authentication order. I am able to use the external account to get into Manage > Security (which requires full access), but when I try to save changes with that account, I'm asked to "Sign in with an account that has full access privileges", but when I enter those same credentials, I'm told: "The account name and password entered doe…

I try to login this morning with google authentication, and the login dialog does not go away. All the rest is standard: Safari comes to the foreground, asks if it can authenticate, I click the OK button. But nothing happens. I tried restarting FileMaker restarting Safari relogin to Google account another browser ( Vivaldi ) restarting the Mac throwing away com.filemaker.client.advanced12.plist I tried on my old MacBook ( I switched to a new one recently ) and there everything works correctly. Next thing I will try is to start throwing away caches, but I wonder: did anyone experience this already? How did you solve it?…

I suspect this has been answered before but my searches aren't finding what I need. I have two databases and I'm linking fields from DB2 to the interface in DB1. I have external authentication going. When user connects to DB1 their asked for authentication for DB2. I don't what them to have access to DB2 and I don't want them to see DB2 as would happen if I were to even give them read only. I've setup the External Data Source between the two FileMaker databases. What might I be missing? I should be able to display data from other databases without giving the user read access to all the databases. I hope you understand what I'm trying to say and thank you for …

FMS15 on MacMini with a known slow LAN and horrible Wifi. Solution consists of 3 files (UI, Data, Documents). All documents are external secured storage. UI and Data open on first window. However, documents file does not open until user navigates to a layout that displays a portal of documents. Therefore, this file is not opened on startup. Occasionally, the documents file does not open and displays "missing." This did not happen FMS12. I thought about scripting the opening of the documents file on open, but was wondering what might be the root cause. No OD, just using OS El Capitan Users and Groups. Tia, B

Hi everyone, The problem I met is about record set is difference between the FM Pro 15 and it behaves at webdirect. Here is the scenario : Table : Contract, Salesperson, User Relationship: User <--[pk]----user_id----[fk]--> Salesperson Contract <-[fk]----sales_id----[pk]--> Salesperson Privilege set : [Manager] - For record, table "Contract" (view) is limited to Salesperson::dept = $$DEPT For layout, view access is allowed [Salesperson] - For record, table "Contract" (view) is limited to Salesperson::user_id = $$USER_ID For layout, view access is allowed…

I'm having an issue with external authentication lately. I'm running FMS 13.0.10.1004 on OSX 10.9.4. Intermittently external authentication seems to not let users in to the database. The server doing the authenticating is sitting right next to the filemaker server. Both on the same network. When I go to System Pref. > Users & Groups on the filemaker server, the network account server is green and appears to be connected. I then do various things in FMS, turn the database server off/on, Go to Database Server > Security > Client Authentication and toggle the accounts dropdown from "FM and External" to "FM Accounts Only" and back again...THEN everyone …

I have an Active Directory for user authentication for our FMP users. I, however, must use unencrypted connection because otherwise it does not work. I have tried and tested the same parameters on other solutions to authenticate against AD, and they work, but with FMS, it works only unencrypted. I read the Manual, it says that I must use a certificate, but my domain is '.local' and I don't understand why it needs a supported certificate for this matter. I did install a certificate for FMP so in order to avoid the annoying web direct security statement. All said, I have a Windows 2008 R2 level domain, with 3 servers to authenticate against. A dedicated FM…

Thankfully this happens rarely, but on occasion users are not able to open any hosted files when presenting the proper credentials. We're using external authentication with Active Directory. I've noticed this issue with FMServer 11-13, Mac or Windows server OS doesn't matter. I am able to open hosted files with a local account and password, it's only externally authenticated accounts that can't be used. It appears that the server is no longer able to communicate with the Active Directory. It happens regardless of wether there are users on the server currently or not. The only way that I've found to cure the issue is to reboot the server. Which isn't a solution that …

I am in the process of upgrading 4 related FM11 files to FM14. They will be hosted on Windows Server 2012. All user accounts and security groups have been set up in Active Directory. Three of the four files work as expected, On the fourth file, I am prompted for a user name and password, I can user either the local admin password or my user name which is then authenticated by Windows - my user name is not set up locally. I have tried everything I could think of, but still nowhere. I've tried using different users credentials with varying permission levels, including an account with full access, still no luck.Any thoughts on why this one file is acting this way.

Need your assistance. I am trying to enable External Authentication with Filemaker 14 Server. Application Server is member of Domain Controller windows 2008. I have enabled "External Authentication" in the Database Server, Security. Database has external server selected authenticated as, the group is added and the privilege is set to data entry. Everything seems to be setup correctly and when trying to open external database it does not work. I have to enter the local file credentials to open database. One thing is that my group is not in the same location as the default windows Organizational Unit group, this group is located in a different location within the A…

Recently in another venue massive confusion apparently erupted about the processes needed to enable External Server Authentication (EA). EA is a highly useful and very important feature of the FileMaker Platform. I have written about it here on FM Forums extensively, including:  http://fmforums.com/forum/blog/13/entry-83-the-power-and-advantages-of-external-server-authentication-with-filemaker-server/  There is considerable confusion apparently about how to configure EA. It is actually very simple to configure. In the Security Tab of FileMaker Server Admin Console select the option for FileMaker and External Server Accounts, as shown:   And, then,…

I'm wondering (because I have not been able to get it to work so far) if my scenario is even possible.  Mac Pro tower running Yosemite and FileMaker Server 13.0.3.300. -system resides on network but not bound/associated to any particular Directory service, Active Directory or Open Directory  FileMaker Pro clients running Windows 7 and FileMaker Pro 13 -any and all of these client pc's reside on the same network, slightly different subnet -all pc's are a part of Windows Domain that is administered by the state dept for my government agency -all pc's can access FM databases when file-level authentication is used  I want to keep from creating and managing a s…

FMS13v0.3 running MacOS Mavericks 10.9.5. hosted file = FMServer_Sample (as shipped, just added priv set and group) on FMS13 Security tab Client Authentication = Filemaker and External Server accounts. OS user, fm_user, is a member of fm_group created by OS Users and Groups (there is no Domain Controller). new group defined in file, fm_group and is set to authenticate via: External Server new privilege set named "fm_group" assigned to fm_group and is set to Access via FileMaker Network Cannot login to FMServer_Sample using account fm_user. Can login to Mac (FMS) using account fm_user. Help requested, Barbara

Hi, Beacuse I want to maintain users more easily I want to change several FM Server hosted files to External Authentication instead of FM Authentication. I have tested it, and it works fine so far on when using a FM Pro Client, and the external Auhenticator is the Active Directory on a Windows Server. But I can not make it Work on FM Go or when using Webdirect. So my question is, is it possible to make it work on the following: Filemaker Go WebDirect PHP Web Publishing (for security I might want to create an separate account for this directly in FM) Filemaker Pro clients running on machines that are NOT domain (AD) members. There doesnt seem to be a …

Hi All, We just installed a new FileMaker Server 13 on a Windows host and configured to use External Authentication with Active Directory. We were doing some initial test that appeared not to be working until we used the fully qualified domain username (i.e.: [email protected]). Does anyone know why it won't just authenticate with the username (i.e. jon.smith)? Thanks, Rich

Hello everybody, I also posted this on the FileMaker forums but unfortunately got no response. I configured my FileMaker Server 10 (on Small Business Server 2008) to allow login via External Authentication. I also created a global group "testgroup" and assigned my user "testuser" to the group. In the FileMaker database I created the group account for "testgroup". When I want to open the database (open remote without filter, then select database) I still get the credential window. However, when I enter testgrouptestuser I can login using the password of my domain user. So authentication works, SSO unfortunately not. Any idea where to look? Thanks Stev…

If I use external authentication with a Mac OS X Server, will users login to FileMaker with their short name or their long name, or both? If I use Get ( AccountName ), will it return the short name, long name, or does it depend on which one they used to login?

Will LDAP authentication work when a user attempts to log in with their long name (ie., Shawn Mishler) as opposed to their short name (ie., smishler)? If so, I assume Get (AccountName) will return the user's long name? Thanks.

All Mac environment. Some new accounts cannot log into FileMaker. They are in the same group as the ones that can. Deleted and recreatead account. Any ideas here? Mac oS X 10.8.5 FileMaker Server 12 Advanced 12.0.5.551

Hi, I currently have two older mac mini servers. One is a filemaker 11 server and the other is a file server with the users and groups on it. I am able to establish external authentication between the two servers so I can have one login for filemaker and the file server just fine. I am developing a new Filemaker 13 system on two additional mac mini new servers (mavericks) using Filemaker 13 server on one machine and the other is going to be a file server with the users and groups on it. Pretty much the same setup as the one described above. My problem is that on the new setup I have Open Directory on the second server (the file server) on and in system pref &g…

We are checking out FileMaker 13 Server. It is installed on a new Mac mini server running Mavericks with all updates applied. I have been able to join the server to our Active Directory domain, but I cannot get External Authentication to work on files created with FMP13. To test if authentication works at all, I copied one of the files from our older server (FMS12, running Lion) to the new server. I am able to open this file using my domain credentials. The same domain accounts have been entered for authentication in both files, but when I try to open the file created with FMP13, I get the message "The account and password you entered cannot be used to access this fil…

I recently installed FMS13, after uninstalling FMSA12 from my test server, and since doing that, I've noticed that there's a significantly longer delay that happens when authenticating with AD accounts than there used to be. This happens whether using FMP clients or with Webdirect. I see this ~5-10 second delay about 40-60% of the time when I connect to one of my databases employing AD authentication. The same databases didn't have this when using FMSA12 on the test server, nor do they have this delay on our production FMSA12 server. I'd like to know if anyone else is seeing this, and if there's a way around this prior to going live in production with FMS13. Thank…

Hi All, We have AD based External authentication working however I have a question about our mac clients and using shortnames vs longnames. Some server details: We're using server 2008 R2 based AD domain controller. We're using FMServer 12 Advanced running on a separate Windows 7 Enterprise VM. Our FMServer is a domain member. We haven't configured LDAP (yet) Test database has a external auth group titled "staff" We have an AD Group in "Users" titled "staff" Our clients details Windows clients are running Windows 7 Enterprise and Filemaker Pro 12 client Windows Clients are bound directly to the domain and are signed in using AD accounts Mac clients…

Hoping someone can help with this. I'm working with a company that has a website. They would like to at least partially replace the functionality of the site with a FM GO iPad interface accessing their SQL data. We would like to use the existing website logins which sit in a SQL table, including encrypted passwords. External authentication, at least as I understand it, isn't possible because they do not run Active Directory or the like on the server machine. The administrator has expressed extreme reluctance to create a directory on the server which would include non-employees. (The FM GO application is for both employees and clients) Is there any way to use …

We're (finally) migrating from FileMaker account to using Windows-based external authentication. Many of our tables have "Created By" and "Modified By" fields that are auto-entered using the Creation and Modification Account Name options, respectively. I was aware of the fact that the account name can appear in multiple forms (username, DOMAINusername, [email protected], etc.) so I wrote a custom function to remove everything except the username. Instead of the built-in options, I set the fields to auto-enter a Calculated value containing my custom function. This works in both "Created By" and "Modified By" fields when I create a new record but when I change a reco…

Greetings, Although not an expert by any means, I've been using FMPRo for some time (back to the FMPro 4 days), mostly for building solutions needed by the HigherEd I work for. We've been using solutions hosted from FMPro server with external authentication for years, and generally speaking have no issues. I've been sneaking around on the FMForums.com site for some time, and have gotten great information and ideas. This is the first time I've ever been so stumped as to need to post for assistance. Today, I'm working on an FMPro 12 database, hosted from an FMPro 12 Server Advanced, and also hosting this via IWP (IWP is not part of this issue at the moment, just tr…

We have a large number of databases - 95 - hosted on a Filemaker 11 Server Advanced running on Windows Server, with 55 users logging in using 12 user accounts.This works reliably, but we have reached the point where we want to change passwords on the accounts, which is a mammoth task and will require taking the system offline for around a day. We're considering migrating to Server External Authentication. (We've have already got EA set up and working for a few accounts accessing a third party database on our server, so we know that part works.) We think that we'd need to proceed as follows: Set up a set of Windows Domain groups, one to match each of the 12 user acc…

Folks I am setting up a new server (FMSA 11.0.4.404) on a 10.7.2 (client OS) on a brand new machine. I have set the server to authenticate using external authentication via the Directory Utility against a 10.6.4 Open Directory Server. The only hiccup is that it will only authenticate the users, when they use their short names not their Full Names. I have double checked that all the groups are lowercase and they have no spaces in their names. I have checked to make sure they are all spelled the same. I have checked that the Directory Editor (on the very same machine) can authenticate via the Full Name (realname) I have used external authentication since it came out (…

Our cyber team is testing implementation of NTLMv2 and it's creating a problem. Users are unable to authenticate with their active directory login to FMSA12. Does anyone have some guidance on this issue? Really need help. We have 100's of FM db's and users.

I am looking to use External Authentication (Active Directory) on my server-hosted filemaker files. The problem is that I have multiple filemaker files and each file has its own security settings. A user can have access to many filemaker databases and the privilege set varies with the databases. To achieve the level of granularity in the security settings, it seems that I will need to create an AD group for each privillege set for every database. Is there a better way to do this that will reduce the number of AD groups? Can External Authentication be used for just authentication and a different mechanism used for authorization.

Hi All, I am working on project to implement SSH(Secure Shell) using FileMaker interface. In general word, to implement SVN using FileMaker. Generally, we have only CUI, if we use Terminal to implement this. But I need an interface to be used in a very user-friend way. Then there will be no need to know the different commands of SSH in terminal. I will be very much for any support. And one more thing, it must be accessible from any platform/OS. First I am using MAC as priority. Thanks

Hello - Is it possible to authenticate to two directories - OD and AD each on separate computers. cheers

Hi, I've read the tech brief on External Server Authentication as well as looked through the last few pages of topics for some clues to my answer, but I can't seem to fix the problem I'm having. I can't authenticate an external user in my FileMaker database. Here's my setup: Server: FileMaker Server 11 running on Mac OS X Server 10.6.8 Enabled Client authentication using "FileMaker and external server accounts" Database: Created an External Server Account named 'fmgroup' Users/Group: On Mac OS X Server, used System Prefs to create a new user named 'externaltest'. Used Workgroup Manager to assign this user to the group 'fmgroup' From my FileMaker…

Hi. Sorry if this is a long post. I'll try to be concise. I have a G5 xServe running 10.5 that has been running my FileMaker Server Advanced 10 server. I currently have a 10.6 OD network (consisting of two Open Directory servers). There is no money in the budget for another Mac server, however, we have an VMWare host that has plenty of ram to create a new vm for FileMaker Server running Windows. Easy solution, or so I thought. Currently Filemaker server is set for external authentication and goes to OD for multiple groups. Works great for Filemaker clients as well as for IWP. Installed 2008 (non R2 as that can not connect to a PDC (NT 4) domain tha…

Hello, I can't seem to find detailed information on this setup and was wondering if I could get some help. Current SetUp: FMS 11 on an OSX 10.8 Machine that is bound to the Active Directory Windows 2008 Domain Controller running Active Directory Security Group with my user in it named FM On FMS: - in the server address I have the IP address of out Domain Controller - in the entry point i have ou=users, dc=mydomainname.dom, dc=dom - Windows authentication is on, domain admin username and password is entered. Insite test database: - Turned on FM network access and can log into the test database with a created full access user. - I create…

Hello, i'm new to this forum. Strange provblem here: -one domain (windows 2008R2): -Domaincontroller is a different computer -filemaker server is member of this domain. -Now we have set up this computer completly new (for old hardware reasons, before 2003, now 2008R2) (same name, same ip, Filemaker 10 server installed, same databases hosted) -After this external auth doesn't work! -in Admin Console "filemaker and external server accounts" is set. The FM_USER Group isn't changed in the domain. The same Group FM_USER is configured in the AD (with same settings it was working before, no new group, no new settings in the database), the …

We have a third party database hosted on our production FMP11 Server Advanced which is used by the development team. The database can be accessed either by a user login or using External Authentication. Through the user account, anyone can log in by just opening the database, as it is set to open with a preset user account. If you are a member of the appropriate EA group then you will also be able to log in by just opening the database. A feature of the database is the ability to turn off the user account so that only EA users can log in - this allows us to limit access to the development team simply by making them members of the EA group. This seemed fine unti…

I have a working and successfully configured FileMaker Server which uses external authentication to our AD. Users can login fine but there is a bit of a functional caveat we would like to address. In our domain we have users that actually authenticate against a kerberos realm. We can manage these users in the AD and add them to the FileMaker groups (they can login just fine!) but the users must login as <username>@LOGIN.DOMAIN.COM--it is impossible with the domain setup to allow authentication for these users with simply <username>. I had a thought that if I changed the server computer's default login domain to LOGIN.DOMAIN.COM that these users mig…

For years I have used a starter file as an "icon" on the user's desktop, which then calls the main file on the server, and away we go. External Authentication with Active Directory takes it from there. PC users don't have to enter their credentials if they are properly logged into their workstation. After upgrading from server 9 to 10 (I know, we're behind the times), this no longer works very well. The server tries to use the credentials from the starter file. As a local file cannot authenticate externally, it apparently passes along local credentials. For some reason Server 9 would just ignore this and use external authentication. Server 10 tries to use the local c…

Hello, I wanted to make a new topic that piggy backed off of this post in another thread (given that the post is over 3 years old I felt it better to make a new post rather then to continue posting to that thread): My question is this: Ted clearly states that he has users that will be part of multiple groups in his AD domain. I have recently run into a problem where I have created several externally authenticated groups and have users that are part of multiple groups. Here's my schema: Database 1 FilemakerDeveloperAccess - [Full Access] FilemakerFinanceAccess - [Data Entry Access] FilemakerGeneralAccess - [Data Entry Access] Data…

We have moved to Lion Server on Mac and seem to have missed some configuration as my files are not externally authenticating any more to the OD. I have configured the console to authentic to an external server. Also if I select a group to authenticate the console its says it is validated (so presumably it is recognising the LDAP directory) but if I log into the console as a member of the group it fails.

I have a Filemaker 10 Server running on a Windows 2003 Server with Filemaker 11 clients running on Windows XP. I have two databases created by the same group many years ago that will not allow NT authentication for groups with [Data Entry Only] access. The databases appear as available to the users from the LDAP hosts menu, but they are propmted for password when attempting to open the database. Using the correct password yields a "the account and password you entered cannot be used to access this file" error. However, if I change group security to [Full Access] this does not happen. I also have about ten other imported fm5 databases created by different departments where…

At present we have a system where we have a total of two usernames and passwords for each database. One is for admin the other is for all other users. Between the different databases there are probably four different sets of password possibilities. Everytime someone logs into a database they get asked for a password (or sometimes more than one). I suspect that this system could be a lot more secure and a lot less annoying as well. What is the best way for me to set up separate user accounts for each user so that: a) someone logs in once and then doesn't need to again b ) only sees databases that they specifically have access to c) maintains secu…

We have a server which was running FMS 11v2 on OSXS 10.6.7 quite happily using external authentication (from OD running on a separate machine running OSXS 10.6.6). We applied the 11v3 update and trouble started. Some users were able to log in and some could not. This is similar to one of the problems reportedly fixed by the update, and one that we experienced (on a different machine) with 11v1. After an uninstall of FMS and then reinstall, leaving it at 11v2 has restored full functionality. We would like to get the server updated as a number of issues are resolved by the 11v3 update. Any ideas?

Since yesterday we started to have issues trying to access aour DB by WEB as we use to do it we have a powerMac G5 Mac as FM server and have the Server advanced (9.0 3) with MacOS 10.5.8and 4GB Ram, we reviewed the settingsfor directory service and nothing cnahged but all the users whne try to access using the AD user/password shows a message : "The account and password you entered cannot be used to access this file. Please try again." We didn't update any thing on the OS, any suggestions will be very appreciated. Thks PS this happens also for users with FM PRo Clients trying to access databaeses using the AD accounts, with the administrator password …

I'm trying to us AD as the authentication method for a Filemaker database. I have Filemaker Advanced Server 11 running and Filemaker authentication is working. Our network Admin created a group called FM and made me a member. In the database I added an account (File, manage, security) with a Group Name FM, Account is authenticated via External Server, Active, Privilege Set [Data Entry Only]. When I click on the User Data button, no account names show up? I assume I should see the list of users in the group from Active Directory. When I try to log on to the database with my AD user id & password I receive a message stating “The account and password you enter…

We have an inventory database that is accessed by two workgroups through external authentication via Open Directory. One of groups has all of our team members in it so they can do inventory changes while out in the field. The other group has access to our stockroom and are the only ones that can remove a item from "stock" and place it as deployed. The problem I'm having is that two of the members from the lesser privileged group are also in the higher privileged "Stock" group. The database will use the lesser privileged group for those two individuals NO MATTER WHAT. We have the authentication order set correctly for the workgroup as well as having that groups privile…

I'm running FMPro Adv Server 11. I have a bunch of DB's up .. all using our AD for authentication. I put one up the other day .. added our IT group with full access, and another group with Data Entry ... The people I put in the AD group to do DE .. they can not access the file.. I tried another group, same thing .. it seems there are some AD groups which work and some that don't. Any ideas on what to look at to figure what it's doing ... or is there a secret kick I can give the server?

Did I imagine it or can I manage security of a file via a separate file which contains just users? Both files to be hosted on the server. FMP11

Is it possible to have a script re-login using an external account? We have SSO working great when the file initially opens, but we would like to allow the user to perform some functions using a local Filemaker account, and then relogin as their AD account without without having to close the file and open it again. Also, when the user is not in the active directory group designated in the external account, is there a way to have Filemaker not ask for a login? We would rather give the user a message that they need to contact the Administrator about being added to the Group. Unfortunat4ely this happens before the file opens so I can't display any message at this point.…

When I change the group of a person in LDAP of snow leopard server, the changes don't work in Filemaker Server 11 Advanced. It looks like there is a very long delay, after a few hours it works finaly.

Hi all. I've been reading some white papers and tech briefs about external authentication and I have a hunch that it might be what I need. If I am not asking too much, I would like to share with you my ideas in order to prove me wrong or right and continue towards the correct direction. Let me say for start that I have a little local network inside which there is a server (Win Server 2003R2) running FM Server 10 Advanced, hosting some databases (in some cases "talking" to each other). There is no Open/Active Directory, Domain Server or other complicated setup. In fact, Filemaker Server is under a One-Machine deployment. It would be nice if I don't need to imple…

I have FMPro advanced server setup on a windows 2003 member server. The domain controller is a separate box then the FMPro server. I have uploaded a database and created a group called FMPRO9 as an external authenication group with read only rights to the test database. I have configured the server and ran the AD test which comes back as successful. I then added my AD account and another users account to the FMPRO security group on the windows domain. I tested accessing the database before and after adding the users to the group. Since I setup the security to hide the databases when you do not have access I could not see them prior to adding myself to the group. Af…

Hi, We have FM server 11 advanced installed on Windows 2008 Standard R2 server with IIS7. We want to access the FM database from PHP using external authentication. Here are setup we have done 1. Created groups and users on computer. Associated users and groups 2. Created accounts in fp7 file hosted on fmserver for group names created in step 1. 3. Enabled the FM server to allow client authentication by external accounts. We can access the fp7 database from FM pro with external authentication (users created in step1). But when we run php page, which access same database with same user credentials, it gives error - 22: unknown error. Are we missing any settin…

Our office is using oditech.com to host our FM Db file. All workstations in our office are Mac OS X 10.6. Recently, one of our workstations is unable to access the file hosted on ODI through the 'Open Remote' command. Every other workstation can log in as usual, no problems. Checking the workstation console log, no changes have been effected that would cause this problem. Any idea what's up? Thanks in advance for the help. R

I've been trying to track the answer to this down myself but not much luck so I thought I'd turn to the community for some help. Running Server Adv 10 on Win2003 Server with mixed clients all at 10.03. AD authentication is enabled as well as internal FMPro authentication. Databases operate normally after a server restart but then after a number of days AD authentication just stops working while internal FMPro credentials work fine. Attempting to stop the database engine and the web publishing engine usually fails as does stopping the Filemaker service. Restarting the server restores the AD authentication but only for a few days or maybe a week. I've checked NTP …

Hello all, I'm triying to login in a filemaker server using Open directory in Snow leopard server so I created 2 users: first.user member of Domain admins, Domain users, fmsadmin second.user member of Domain users and fmsusers (a group that I created in the directory). fmsadmin has full access to the file, fmsusers has restricted access (data entry only). I want to say that both users are recognized by the domain controller (both users can authenticate in a Windows Vista business machine, load their roaming profiles and privileges properly). only first.user can open filemaker files (even if I change the group membership to fmsusers). At …

Hi, We just bought a Mac Mini Server and it's my first experience with Mac. I'm having trouble to authenticate using external authentication. I enabled external authentication for the Admin Console of FMS11 and for the hosted files. Concerning the admin console, the external group is recognized. Concerning the FMPro clients there are all on XP. I want the user to be able to use the Single Sign-On capabilities. So here are the configs : - Active directory on Windows Server 2003 Standard - FMS11 on Snow Leopard - FMPro on XP Thanks

I am new, I need help, please excuse me for simple question. My local office has 10 computers; 50 computers (include oversea offices) Local office all have access to a Shared Drive/Folder S. I installed Filemaker Pro 10 Adv. to the Drive S. I want all 10 computers to be able to run Filemaker. It did not work. I get "Error: This application has been installed incorrectly or modified by another program. Please run the installer to get a fresh copy of the application after determining the cause." So, do I need to independently install a Filemaker onto every computer? (do I need to buy 50 CDs or 1 CD installed onto multiple computers?) Web Publ…

Any help would be greatly appreciated . . . 1) Our master open ldap server is on a mac 10.5.8 server. 2) We have a 10.4.8 server running FMS 10 adv. This machine is connected to our master directory system and is authenticating external accounts correctly in our FM solutions both native and web. 3) We installed FMS 11 adv on a 10.6.3 server. It is also connected to the open ldap master. (a terminal window with id account_name returns the correct information). The FMS 11 adv console has been set to allow FM accounts and external accounts in the security tab. However when trying to open a remote solution our external accounts fail. 4) If we can resolve …

Hello FileMaker Folks I'm attempting something that might be utter madness, but seems reasonable (famous last words, I bet) running FM Server Advanced 11 on a Windows Server 2003 machine, with LDAP authentication against a Mac OS X Open Directory server. This arrangement has been fine on FMS10 running on a Mac OS X machine, but although the admin console on Windows FMS11 says the directory service is configured correctly, when clients try to log in, no external authentication takes place. I'm a bit stuck, and of course the nice people at FM tell me this is an OS level problem so not for them to solve. Can anyone else? Is this theoretically possible? I haven't ye…

I am about to change my Filemaker Pro Web applications to External Authentication, which I believe means that an Apache module is integrated into the library and then Filemaker Server is switched to Filemaker and External Server Authentication. First of all, is this true or am I missing something? Secondly, where can I find good documentation about this?I have looked on Filemaker, but can't find anything on the latest versions of Filemaker that discuss this topic. Also, any tips on what to be careful of or avoid?

Colleagues: It has come to my attention from several venues in recent days that any number of developers, IT Administrators, and “power” users are having difficulty understanding and in configuring External Server Authentication of accounts with various versions of FileMaker Server. Here are a few key points to keep in mind: 1. External Authentication removes the credentials information (Account Name and Account Password) from within a FileMaker Pro file and transfers it to FileMaker Server. This allows multiple different FileMaker files to use the same single set of credentials. 2. Inherent in this process, and central to it, is that the Acc…

I have a client who uses SMTPit and POP3IT to download and send email via FileMaker. Currently they have about 40 users and I have a FileMaker file that houses all of their signons and passwords (used with POP3it) I have just changed FileMaker to authenticate via their Active Directory which works well so I can use Get(Account Name) to see who logs in, but I can’t figure out any way to pass on their password to POP3IT so they can download email. Every so often users have to change their passwords and then we have to update in the FileMaker staff table and I want to do away with that so it’s all done via the Active Directory. Any ideas how this can…

Hi all I have been looking at this all day and can't seem to find a solution. We have two Filemaker server, one on Windows and one on Mac OS X Server 10.4.11. I have got the external authentication working perfectly on the databases hosted on the windows server but cannot find how to use the AD server for the Mac OS X server. Not sure if this is the correct procedure, but I have tried to Bind the OS X server to AD using the Directory Access utility, but I keep getting an error "unable to access domain controller. this computer is unable to access the domain controller for an unknown reason" In windows all I had to do was set the service to authenticat…

Hi, I have a Windows 2003 server / XP workstation /Filemaker Server 10 network, single domain. All latest patches are regularly applied to servers, workstations and the FMS. FMS is intalled on a member server machine (no AD on that machine). There are two DCs on the network (two servers containing AD and replicating to each other). The network works fine in all respects and all software is also working fine. However, client Filemaker Pro 10 machines fail Single Sign On under the following conditions: - Upon restarting one of the DC servers (which does not make any sense, as FMS could use the other to reach AD; in fact, users can restart their machine and lo…

Am looking for a definitive resources that states that Integrated Windows Authentication can be made to work with Instant Web Publishing or not. It hasn't in the past, but realize the product is constantly being enhanced or 'workarounds' are made? Use would flourish here if this could be accomplished.

We are going to be implementing a new system in a few months and we really want to use External Authentication. We have a production server, and we will have a testing server. Is there a way - without having active directory involved(as we do not have a domain controller) to have the users from our test server authenticate to the production server so that we do not have to maintain two separate lists? Is this possible, and if so, any thoughts would be greatly appreciated.

Hi FMForums I have a problem when opening files hosted on FMS10A, with AD authentication setup. The files eventually open OK - takes a while, however I think that's because of this problem; during this opening process I get lots of emails from the FM server saying that Authentication has failed. This is the case which ever database file is opened. Any one got any ideas on how to: A: Speed up the opening process (opening 50 files can take 10-15 minutes!) B: Stop these error messages?

I'm trying to set up a scheduled script in FileMaker Server 10 on Snow leopard server 10.6.1. I have Full-access Accounts using external authentication and am able to log in to the database with them using Filemaker Pro Advance 10. When I attempt to set up the schedual I can't get past the "Select a Database to Run the Script" page using any of the accounts that use external authentication, but I can get to the next page if I use a Full-Access account authenticated by fileMaker (i.e. the admin account.) Is it even possible to use external authentication accounts for a scheduled script? Are FileMaker authenticated accounts required for Scheduled scripts? Is my da…

Hi I am trying to configure Directory Service with Novell eDirectory (NetWare 5). I tried all ways that I can think of and all the solutions through help(mostly AD solutions are available) but no success yet. Can anyone helpme or show me the right path? Thanks in advance

Hello all, this morning I restarted both DC and FMS in order upgrade our system. I closed FMS first then DC then I restart them in reverse order. DC didn't start properly the first time (some service fail to initialize and it couldn't load Active directory and DNS server) but, unfortunately I discoverd this problem after FMS startup so the database service (which uses AD as external authentication directory) refuse to logon all the domain users even if now DC is properly running and I can only open the files using the Open recent feature in "File" menu. I'm wondering if I can 'refresh' FMS without restart the entire service (which mean close all file, disconnect al…

Does External Server Authentication require any particular processes in order to work correctly? Sometime between last night and this morning, it just stopped working on my server, users could no longer log in with external accounts... everything else was fine, and restarting the server-computer (FMPS and the OD Server used for authentication are on the same machine) got it working again. The only cause for the problem I can think of & haven't eliminated is some process crashing & not restarting. But I don't know what exactly to look for. Thanks.

We are running IWP-hosted FileMaker databases from a server running OS 10.5. We are switching from internal to Open Directory external authentication for most users. Is there any problem if users have identical accounts (same account name and password) in the external group and as internal accounts in a database? This has come up as a transition question, i.e. should we delete or disable the internal accounts as soon as we set up an external account for a given user. The external group is set at the top of the account list in FileMaker so it should be first authentication used when someone logs in.

I'm trying to implement external authentication via Active Directory for our Macs and PCs with 'Single Sign On' for our Windows clients. I've tried to closely follow the FM8_server_auth tech brief but domain accounts aren't yet working. I've tried to authenticate from a Mac not on the domain, but using domain credentials when prompted, and from a PC logged into the domain, both fail. All machines are on a local network. Some clients are on FMP8, though my test machines are using FMP10. Our Server: Windows Server 2003 sp2 FileMaker Server 9.0.3.326 Hosting FM database: 'Mydatabase' Client Authentication: FileMaker and external accounts File Display Filter…

I have three groups (Admin,Staff,student) in active directory. How can I design a login page by which I can redirect each user based on their login credentials (groups). Because I have to redirect Admin and staff to one webpage and student to another. And I want to make sure that student does not get access to the staff and admin webpages. Any help would be highly appreciated. Thanks in advance.