Creating a Directory Server Connection

1. On the Directory Servers page, ensure the applicable tab is active, depending on the directory server type to which you want to connect:
• Windows Active Directory; or
• Generic Directory: Other LDAP-based directory
2. Click New. The Create New Server Connection page opens.
3. Complete the fields below, then click OK.
4. When finished, proceed to Adding Users and Roles from a Directory Server Connection.

Create New Server Connection

• Name: Provide a name for the connection.
• Host: The host name of the directory server.

Note: If Authentication Type (below) is SASL, and Host is an IP address, you must also specify a Realm.

To get the host name
From AD Explorer:
1. Select File > Connect..., and click OK, leaving all values blank.
2. If AD Explorer successfully connects to Windows Active Directory, the host name is printed in square brackets.
From a domain computer:
1. Open a command prompt (cmd.exe) via the Start menu.
2. Type gpresult /r to display the policy information for the current user.
3. The directory server appears under 'Group Policy was applied from'.
• Port: The port that is used to communicate with the directory server. Most common Windows domain configurations use port 389 or 636.
• Connection Encryption: The encryption method to use when authenticating with the directory server.
• None: No encryption
• SSL/StartTLS: Communication is over secure sockets layer (SSL). If StartTLS is specified, SSL/TLS communication is initiated using the STARTTLS command.

Note: To use a certification authority (CA) certificate for SSL authentication, see Importing a CA Certificate for SSL Connections.

• Search Account Name: A Windows Service Account to use for importing directory server users and groups into FME Server. This account requires read access to the domain controller.

Specify the account in any of the following formats:

Format	Syntax	Example
NT Login	DOMAIN\username	MYCOMPANY\User1
User Principal Name	username@domain.net	User1@MYCOMPANY.INTERNAL
Distinguished Name	CN=...,OU=...,DC=...	CN=User One,OU=Service Accounts,OU=My Company,DC=company,DC=internal

To get the Service Account name
1. From AD Explorer, connect to the Active Directory.
2. Browse for and select the entry representing the account.
3. The service account name appears under the sAMAccountName' attribute.
• Search Account Password: The password of the directory server account.
• Account Name Attribute: If the active tab is Generic Directory, the directory attribute to use for user account login in FME Server. Typical attributes are UID, mail, or CN.
• Group Name Attribute: If the active tab is Generic Directory, the directory attribute to use for role name in FME Server. A typical attribute is CN.
• User Class: If the active tab isGeneric Directory, the objectClass attribute value that identifies directory users. This value must be consistent for all users, as it is used to search for users in the directory server. Typical attribute values are inetOrgPerson and organizationalPerson.
• Group Class: If the active tab is Generic Directory, the objectClass attribute value that identifies directory groups. This value must be consistent for all groups, as it is used to search for groups in the directory server. A typical attribute value is groupOfNames.

Authentication

• Authentication Type: Specify the method of authenticating with the directory server:
• Basic: SASL authentication is not enabled.
• SASL: Enables simple authentication and security level (SASL).
  • SASL Mechanism:
    • GSSAPI: Kerberos V5 authentication
    • GSS-SPNEGO: Simple and Protected GSSAPI Negotiation Mechanism
    • EXTERNAL: Context-implicit authentication
    • DIGEST-MD5: MD5 message digest
• Enable Single Sign-On: If the active tab is Windows Active Directory, this setting, if checked, allows users imported from this connection to auto-connect to FME Server with their Windows credentials.

Note: To use Single Sign-On, you must also update your Windows domain and web browser configurations. For more information, see Configuring Integrated Windows Authentication.

• Service Account Name: The name of the Windows Service Account to configure for single sign on, in the format USERNAME (do not specify DOMAIN).
To get the Service Account name
1. From AD Explorer, connect to the Active Directory.
2. Browse for and select the entry representing the account.
3. The service account name appears under the sAMAccountName' attribute.
• Service Account Password: The Windows service account password.

Optional fields

• Enable Synchronization: When checked, the connection synchronizes with the directory server at specified intervals. Information that synchronizes includes:
• Relationships between users and groups. For example, consider User_1 who belongs to Group_1 in FME Server because of a corresponding relationship in the directory server. If that relationship is subsequently broken in the directory server, the relationship between User_1 and Group_1 will break in FME Server after the next synchronization interval. Likewise, if a directory server user changes groups, that change will synchronize in FME Server.
• Name changes to user accounts on the directory server.

Note: When synchronization occurs, FME Server ensures any directory server name change does not break the user's connection to FME Server. However, FME Server does not update the user's login name (Username) or display name (Full Name).

Note: If Enable Synchronization is not checked, you can still synchronize the connection manually after it is created. For more information, see To perform other tasks on Directory Server Connections.

• Synchronization Interval: Specify the desired frequency of synchronization.
• KDC Host: If the active tab is Windows Active Directory and SASL Mechanism is GSSAPI, specify the host name or IP address of the Kerberos key distribution centre (KDC). If not specified, the KDC is assumed to be located on the same server as the Active Directory domain controller.
• Realm: If the active tab is Windows Active Directory and SASL Mechanism is GSSAPI or DIGEST-MD5, specify the authentication realm for Kerberos V5 or MD5 message digest authentication. On Active Directory, the authentication realm is the domain name. Specify the capitalized version of the domain name, in its fully-qualified domain name (FQDN) form. For example, if the FQDN is domain.net, use DOMAIN.NET. If not specified, the authentication realm is assumed to be the domain name of the Active Directory Domain Controller.

Note: If Host is an IP address, you must specify a Realm.

To get the fully-qualified domain name (FQDN):
From a domain computer:
1. Open a command prompt (cmd.exe) via the Start menu.
2. Do either of the following:
   
   1. Type echo %USERDNSDOMAIN% to display the USERDNSDOMAIN environment variable.
   2. The FQDN will print.

OR:

1. Type net config workstation to display the network settings for the computer.
2. The FQDN appears under the 'Workstation Domain DNS Name' field.
From the domain controller:
1. Open 'Active Directory Domains and Trusts' from the Start menu.
2. In the console tree (left-hand column), a list of Windows domains are listed by their FQDNs.
• Search Bases: Specify the distinguished name of a section (sub-tree) of the directory server that is accessible to the connection. Any sections not specified are not accessible. If not specified, the entire directory is accessible.
To get the distinguished name
1. From AD Explorer, connect to the Active Directory.
2. Browse the directory to determine the location of all users and security groups to be provided access to FME Server.
3. Select an entry to be used as the naming context.
4. The distinguished name appears under the 'distinguishedName' attribute.
• Alternate Servers: Enables FME Server to access the directory server using alternate Host and Port combinations. This setting may be useful in either of these situations:
• The directory server can be accessed from multiple, redundant servers. FME Server uses these servers to access the directory server in a rotating manner, which distributes the load across them.
• If one directory server is inaccessible, FME Server connects to one or more alternate servers.

To add a Host and Port combination, click +. To remove a Host and Port combination, click -.

• Account Name Attribute: If the active tab is Windows Active Directory, the Active Directory attribute to use for user account login in FME Server. For Windows, leave blank to use the account's pre-Windows 2000 login name (sAMAccountName).
• Account Member Attribute: If the active tab is Generic Directory, the directory server attribute that contain a user account’s group membership. This attribute is not present in all directory servers. However, if present, it can make directory access more efficient. A typical attribute is memberOf.
• Group Name Attribute: If the active tab is Windows Active Directory, the attribute to use for the role name in FME Server. For Windows, leave blank to use the group's pre-Windows 2000 group name (sAMAccountName).
• Full Name Attribute: The directory server attribute to use for the user account’s full name in FME Server. If the active tab is:
  • Windows Active Directory: Leave blank for Windows to use displayName.
  • Generic Directory: A typical attribute is displayName.
• Email Attribute: The directory server attribute to use for user account's email address in FME Server. If the active tab is:
  • Windows Active Directory: Leave blank for Windows to use the account's email address (mail).
  • Generic Directory: A typical attribute is mail.

In order for FME Server to communicate with Azure AD, you must create and register FME Server as an enterprise application in Azure AD. Follow the procedure in Configuring Azure Active Directory with FME Server. When finished, proceed as follows:

On the Directory Servers page, ensure the Azure Active Directory tab is active, and click New. The Create New Azure AD Tenant page opens. Complete the fields below, then click OK. When finished, proceed to Adding Users and Roles from a Directory Server Connection.

• Name: Provide a name for the connection.
• Tenant ID: The Directory (tenant) ID that applies to the FME Server registration.
• Tenant Type: Whether the tenant for this connection is a Primary or Secondary tenant. Secondary can be specified only if FME Server is registered in Azure AD to support multiple tenants. Additionally, both of the following conditions must be fulfilled in Azure AD:
  1. The tenant is granted secondary tenant access to FME Server.
  2. FME Server is granted access to the users and groups of the secondary tenant.

  For more information, see Granting Secondary Tenant Access to FME Server in Azure AD.

• Client ID: The Application (client) ID that was generated for the FME Server registration.
• Client Secret: The client secret of the FME Server registration.
• Enable Synchronization: When checked, the connection synchronizes with the directory server at specified intervals. Information that synchronizes includes:
• Relationships between users and groups. For example, consider User_1 who belongs to Group_1 in FME Server because of a corresponding relationship in the directory server. If that relationship is subsequently broken in the directory server, the relationship between User_1 and Group_1 will break in FME Server after the next synchronization interval. Likewise, if a directory server user changes groups, that change will synchronize in FME Server.
• Name changes to user accounts on the directory server.

Note: When synchronization occurs, FME Server ensures any directory server name change does not break the user's connection to FME Server. However, FME Server does not update the user's login name (Username) or display name (Full Name).

Note: If Enable Synchronization is not checked, you can still synchronize the connection manually after it is created. For more information, see To perform other tasks on Directory Server Connections.

• Synchronization Interval: Specify the desired frequency of synchronization.