Role-Based and User-Based Access Control

FME Server security is based on two primary concepts:

• Users: The individual accounts that access FME Server. When FME Server is installed for the first time, default user accounts are created. Note that the default Status of these accounts, except the admin account, is Disabled.
• Roles: Comprised of one or more users.

FME Server security controls access to resources either through role-based or user-based access.

Optionally, you can incorporate your organization's directory server (for example, Windows Active Directory) groups and users into your FME Server security configuration.

Role-Based Access

Roles make it easy to assign the same set of permissions to multiple users based on job function. Permissions to perform certain operations are assigned to specific roles. In turn, these permissions apply to the users who belong to that role.

For example, a request by user user1 could be to run a workspace in the Samples repository for the Data Download Service. FME Server security grants access if any of the roles to which user1 is assigned has permission to run workspaces in the Samples repository, and also has access to the Data Download Service.

FME Server provides a set of default roles:

On the Roles page of the Web User Interface, an administrator can:

• Create and remove roles.
• Configure users in roles.
• Configure permissions of roles.

On the Directory Servers page of the Web User Interface, an administrator can integrate the organization's Windows Active Directory, LDAP, or other directory server groups and users into its FME Server security configuration.

User-Based Access

Another way for FME Server to determine if a user can access a resource is whether the user owns it, or has been given permissions on it.

User Ownership

Anything a user creates in FME Server, such as a repository, is owned by that user. When you own something, you have full permissions on it. This permission supersedes the permissions you have on other items in FME Server based on the role to which you belong.

Additionally, as an owner, you can:

• Share permissions on the items you own with other users or roles.
• Assign ownership of something to another user. To change ownership of an item, edit it from the Items page.

User Permission

Users can be granted permissions on resources, and these permissions may supersede the permissions available to them through their role. (In fact, it is not even necessary for a user to belong to a role.)

On the Users page of the Web User Interface, an administrator can:

• Create and remove users.
• Configure users in roles.
• Configure permissions of users.

On the Directory Servers page of the Web User Interface, an administrator can integrate the organization's Windows Active Directory, LDAP, or other directory server users and groups into its FME Server security configuration.

Shared Access

Through sharing, users can grant different levels of access to items in FME Server to other users or roles. A user can share an item if their account is enabled for sharing, and either of the following is true:

• The user owns the item.
• The user has Manage permission in Security (usually granted to an administrator).

About the Trusted User Account

A special account, referred to as the trusted account, can be used to provide unauthenticated access to any component. By default, this trusted account is named guest and is assigned to the fmeguest role. By default, the fmeguest role is configured to allow unauthenticated access to the FME Server Web Services. This means it is possible to invoke a service URL without providing any credentials.

Note:

The Status of the guest user account is Disabled by default.

If you want all of the FME Server Web Services to prompt for authentication, remove the guest account after you configure your own set of users and access control for your FME Server.

To change the user name and password of the trusted account for a service:

1. Configure the DEFAULT_USER_ID and DEFAULT_PASSWORD parameters in the propertiesFile.properties file for each service. If your FME Server installation uses the built-in Apache Tomcat servlet, these files are located under:

<FMEServerDir>\Utilities\tomcat\webapps\<service>\WEB-INF\conf\propertiesFile.properties

2. Applying the same settings as above, update the name and password of the account on the Users page.

See Also

• Configuring Authentication for the FME Server Web Services
• Web Services Authentication