[FMIWP] Restrict access to fmxml resources

[Frankywinky]

Hi,

I would like to know if it is possible to restrict access to fmxml resources with the IWP of FMSA7 on Mac, to, by example, a range of IP address.

I was thinking of making an .htaccess file, but it seems that fmxml resources are embedded in jakarta tomcat or something like that, I don't know what to do.

And on the other hand, I don't want to block access to all the webserver because I still want to share some fmxslt resources over the internet.

Any ideas would be appreciated !

Frank

[Frankywinky]

Anyone ?

[Steven H. Blackwell]

Not sure I understand your question. IWP doesn't use the xml connectivity. Custom Web Publishing uses that.

Steven

[Frankywinky]

Sorry, it was my mistake. Of course, I was talking about Custom Web Publishing.

Is there a way to control access to http://[webserver]/fmi/xml/fmresultset.xml?... ?

[Steven H. Blackwell]

Well if you want to restrict access via CWP, do not enable the fmxml and fmxslt Extended privileges for the relevant privilege sets and their attached accounts. But I suspect that there is more to what you're trying to do than that?

Steven

[Frankywinky]

Yes, first I have fmxslt resources that I still want everyone to use (by the default user).

Then, I have fmxml resources that are used only by some of our employees. At least, they must enter their username/password to connect to fmxml resources. But, for more security, I wanted to lock access to their IP address, like, in a .htaccess file (we are on Mac)

I'm trying to do something like this .htaccess file, but with Tomcat and only for fmxml resources

deny from all

allow from 192.168.0.43 192.168.0.64 ...

I wish it could be possible...

Thanks for your help

Edited February 14, 2007 by Guest

[Brian C]

You could try putting the ip resctictions directly into your solution somehow... I have only used IWP so I would place that directly into a script that controls access... At least in the FM side you can query and store the current ip of the user and then allow/disallow access... Im not sure how that would work in a cwp solution though.

[Frankywinky]

I could work for XSLT, because there is scripting. But I don't think you can do something like this in fmxml...

But thanks for trying to find a solution :)

[Steven H. Blackwell]

You might want to submit a feature request to FMI to have this in a future version:

http://www.filemaker.com/company/feature_request.html

Steven

[John May - Point In Space]

OK, here goes...

This is assuming on the Mac platform. Can't say for a PC.

If you look at:

/Library/FileMaker Server/Web Publishing/web-configuration/WEB-INF/conf/mod_jk_paths.conf

You can comment out the lines in said file to initially disable the protocols you don't want. Then, make a separate Apache container that uses a container to allow only the IPs you want. Then, add back in the JKFmMount lines you commented out from the above named file to reenable those protocols for the allowed IPs.

- John

[Frankywinky]

Woah, thanks you so much for your reply! This looks exactly like what I was searching for :

I should give it a try monday !

Many thanks !

[Frankywinky]

Hello John,

I've made it work with only this and it seems good

order deny,allow

deny from all

allow from 132.204.90.

Is there any reason we should use a VirtualHost ?

But, anyway, thanks for your help !!

Frank

[John May - Point In Space]

Nope - I suppose that works too =)

- John

[Frankywinky]

Cool, thanks for the tip !