How does this work when using External Authentication?

[Mr. Scott]

Gee, how does this work when your WAN database is hosted on FMS and uses External Authentication?

Thanks in advance,

- - Scott

[Jesse Barnum]

MirrorSync will work fine with external authentication, but you need to set up a username and password in the offline database for the user to be able to open the file. The username must match the external authentication username, but the password does not need to match.

[Mr. Scott]

Hmmm… "The username must match the external authentication username, but the password does not need to match." So, with 50 users or so, I need to create internal usernames that match their Open Directory name that each user has for logging into the hosted solution? Well, I guess that's not too bad, but why does the user name have to match their External Authentication credentials?

- - Scott

[Jesse Barnum]

The main reason is because if all the users shared a single name, like "user", then that is what will get stamped as the last person to modify the records on the server, and we want to discourage that. Therefore, we assume that whatever user name you're logging into the local file with is the same as the user name on the hosted file.

[Mr. Scott]

Excellent! Thanks for replying so promptly, Jesse.

- - Scott

[Jesse Barnum]

I forgot to mention - if you look at the MirrorSync script after pasting it, near the top you'll see where we look for global variables called $$MIRRORSYNC_USERNAME and $$MIRRORSYNC_PASSWORD. If you have your own script that sets the values to a valid account on the server, then the user will not be prompted to enter a password, and it's also allowed for this username to not match the username in the local file. I can't think of good reasons to do this (for the same reason that I mentioned previously about modification stamps), but the capability is there if you have a special reason for bypassing this rule.

[Mr. Scott]

The documentation states:

"Please note: if the database has multiple access accounts with different privilege sets, make a new copy for each user. Do not sync an offline copy of the database to the server using multiple accounts."

Does this mean that once I choose "download database" that I can distribute that copy to each of my users that are within that privilege set, or do I have to create (download) a new version for each of my users?

- - Scott

[Jesse Barnum]

Good question. It's perfectly fine to download a copy from the server once, and BEFORE SYNCING IT, distribute it to as many users as you want.

What you want to avoid is distributing a copy of the file AFTER it has been synced at least once.

[Mr. Scott]

So, it doesn't matter that I have users with different privilege sets - I can download one copy for distribution and once the user opens that file and logs in with their credentials, they will have only the privileges assigned within the FileMaker security for their unique account, right?

Although somewhat related, I posted another question regarding creating a unidirectional sync version as well as a bi-directional version, so I will look forward to seeing your response to that separate question.

- - Scott

[Jesse Barnum]

Scott, that is correct regarding privilege sets.

[Mr. Scott]

You better hope Apple doesn't approve my trip to DevCon — I'm always full of questions!

Thanks again for your responses.

- - Scott