External Accounts: Open Directory groups

[Charlie Boisseau]

I'm just about to migrate our filemaker system over to our Open Directory server (Mac OS X Server). I'd like to know if it's possible to setup different database permissions for different groups? I want everyone (in the 'staff' group) to access most of the databases, but only a few of those people (who also belong to the 'accounting' group) to be able to access the accounting databases.

Also, my databases all have the full-permissions user called 'admin', however my OS X server administrator account is also aliased 'admin'. Is this likely to confuse filemaker? Should I rename the database account 'fmadmin' or something?

I'm running FileMaker SA 7 on OS X (Standard) 10.3.9 and the Open Directory machine is Mac OS X Server 10.3.9.

Thanks.

[Wim Decorte]

The whole concept of External Authentication in FileMaker is about groups. So what you want to achieve is entirely doable. Download the EA white paper from the filemaker website for an in-depth discussion.

In a nutshell this is how it works:

- FMP sends the user's credentials to FMS

- FMS sends those to the OD server

- if the OD server authenticates the user then it sends a list of groups that user belongs back to FMS

- FMS matches that list with the list of accounts in the FM file.

(Important note here: external accounts in the FM file are really OD group names. The user does not have an individual account in his name in the FM file)

- if FMS finds a matching group (it will stop at the first match) then it will apply the privilege set that you chose for that account.

The privilege set in other words is where you set up permissions what the user can and can not do in the file.

About the admin account: no problem. Set up an external account in FM that matches the OD administrators group name and you're set

[Charlie Boisseau]

Great! Can you tell me where the EA white paper is? I can't find it on filemaker.com.

Cheers.