AD Authentication fails

[kwandtke]

I'm running FMPro Adv Server 11. I have a bunch of DB's up .. all using our AD for authentication. I put one up the other day .. added our IT group with full access, and another group with Data Entry ... The people I put in the AD group to do DE .. they can not access the file.. I tried another group, same thing .. it seems there are some AD groups which work and some that don't.

Any ideas on what to look at to figure what it's doing ... or is there a secret kick I can give the server?

[Wim Decorte]

No tricks, it's very binary: either it works for everybody or it fails for everybody.

Since it works for one group but not for another in your deployment it can be:

- that the names of the groups don't match with the name of the group in the AD

- that the priv set attached to the externally authenticated FM account does not have the fmapp extended priv toggled on

- the users have matching accounts in the OS of the FMS machine (maybe left over from testing?)

- their machine clocks are out of whack with the FMS machine clock (are you using SSO? Are the workstations on the same AD and do the users log into the OS with the AD accounts?)

[Steven H. Blackwell]

I'm running FMPro Adv Server 11. I have a bunch of DB's up .. all using our AD for authentication. I put one up the other day .. added our IT group with full access,

This is extremely inadvisable. Do not assign external accounts [Full Access] privileges.

Steven