External Server Authenticated

[Wiz Bang Computers]

I am trying to set up External Server Authenticated accounts using FM 8. I tried to build several accounts and then when I sent to save it would not accept my ID and password by running to server to check. I had to have a FM authenticated password to get this to work. Am I doing everything right? Can you all give me some tips for setting up External Server Authenticated?

[Wim Decorte]

Hi Wiz,

Start here:

http://www.filemaker.com/downloads/pdf/techbrief_fm8_server_auth.pdf

You always need one real FM account in your files. That's in case you need admin access to file when the domain server is not available.

As to setting up EA accounts: it's not clear from your description what exactly goes wrong. You don't set up individual external accounts in FM. The individual accounts exist on the domain controller. In FM you create "accounts" that match group names on your domain controller.

If I ("wim") exist in a group "geeks" on the domain controller. Then you'd set up a FM EA account named "geeks". When I log into my computer and open the FM file, the OS would tell FM that I'm "wim". FMS would query the domain controller for the groups I'm a member of and would get back "geeks" from the domain controller. Since "geeks" matches "geeks" set up as an EA account in the file, I'm in.

[eljefejb]

Hello,

I am trying to set up external authentication at work. We have FM Server 8 running on Mac OS X Server (10.4.5) and clients running FMP8 on Windows XP who must log in to a Windows Domain (2K3 server) before using their computers.

I set everything up according to your instructions in the Server External Authentication PDF doc. It didn't work, so I flipped to the Troubleshooting section, where I read: "Administrators should assure that they have updated to FileMaker Server 8.0v3." In the FileMaker Server Admin tool, (summary section), our server version is listed as 8.0v2 (12-02-2005). I looked on the FileMaker website, and 8.0v2 is the highest update I see. Where is the 8.0v3 update to be found? :idot:

[Steven H. Blackwell]

This is a misprint.

Your OS X Server must be properly registered to the domain. And it's possible that the latest rev to OS X (10.4) broke that functionality again. Carefully examine the Account syntax for the OS X Server to see uts exact style. The groups in the databse must use the same style.

And i have to ask: if the workstations are running Windows XP Pro why aren't you running the FileMaker Server on Windows Server 2003? It would save your enormous amounts of configuration problems.

Steven

[eljefejb]

What Account syntax are you referring to? I made sure the group names in the FM file matched the domain group names I had our IT guy set up. The Mac server is properly registered with the domain. Shows up without problem.

And i have to ask: if the workstations are running Windows XP Pro why aren't you running the FileMaker Server on Windows Server 2003? It would save your enormous amounts of configuration problems.

I wish it were that easy... the boss likes Mac and is trying to slowly move everything that way. Since I'm working on a new setup for our FM files, I get to do it on a Mac server. Our domain controller is still on Windows because that's what our main IT guy likes and is familiar with. So, until the whole system needs an overhaul, I think I'm stuck with what I've got.

Edited March 13, 2006 by Guest

[Steven H. Blackwell]

What Account syntax are you referring to?

The way that the OS X AD plug-in returns the names. OS X has some very strange syntax at times, almost like a UNC syntax, except for Account names. Therefore, despite the fact that the AD Groups match exactly what the Group names in the FMP file are, the AD plug-in on OS X Server may be returning something else. Nice, eh?

Also, be sure you are running the 8.0v2 updater for Server.

Simple fact of the matter is that FMS is much easier to set up and administer on Windows Server 2003 than on OS X Server.

Steven

[eljefejb]

How do you tell what it's returning? I don't see an option for that anywhere. The closest thing I could find was a box that said something about deriving the user's home folder from the UNC path, and I unchecked that.