Creating an Authentication Service Connection

Important  "> Important FME Flowrequires the Windows Active Directory server to:
Disable encryption typeRC4_HMAC_MD5.
启用加密类型AES128_HMAC_SHA1andAES256_HMAC_SHA1.

1. On theAuthentication Servicespage, ensure the applicable tab is active, depending on the authentication service type to which you want to connect:
• Windows Active Directory; or
• Generic Directory: Other LDAP-based directory
2. ClickNew. The Create New Server Connection page opens.
3. Complete the fields below, then clickOK.
4. When finished, proceed toAdding Users and Roles from an Authentication Services Connection.

Create New Server Connection

• Name:Provide a name for the connection.
• Host: The host name or IP address of the authentication service that functions as a domain controller. Round-robin or other load balancing domain controllers are not supported; however,Alternate Serversmay be specifiedbelow(under Optional fields).
Note  "> NoteIfAuthentication Type(below) isSASL, andHostis an IP address, you must also specify aRealm.
To get the host name
FromAD Explorer:
1. Select File > Connect..., and click OK, leaving all values blank.
2. If AD Explorer successfully connects to Windows Active Directory, the host name is printed in square brackets.
From a domain computer:
1. Open a command prompt (cmd.exe) via the Start menu.
2. Typegpresult /rto display the policy information for the current user.
3. The authentication service appears under 'Group Policy was applied from'.
• Port: The port that is used to communicate with the authentication services. Most common Windows domain configurations use port 389 or 636.
• Connection Encryption: The encryption method to use when authenticating with the authentication service.
• None: No encryption
• SSL/StartTLS: Communication is oversecure sockets layer (SSL). If StartTLS is specified, SSL/TLS communication is initiated using theSTARTTLScommand.
Note  "> NoteTo use a certification authority (CA) certificate for SSL authentication, seeImporting a CA Certificate for SSL Connections.
• Search Account Name: A WindowsService Accountto use for importing authentication service users and groups intoFME Flow. This account requires read access to the domain controller.

Specify the account in any of the following formats:

Format	Syntax	Example
NT Login	DOMAIN\username	MYCOMPANY\User1
User Principal Name	username@domain.net	User1@MYCOMPANY.INTERNAL
Distinguished Name	CN=...,OU=...,DC=...	CN=User One,OU=Service Accounts,OU=My Company,DC=company,DC=internal

To get the Service Account name
1. FromAD Explorer, connect to the Active Directory.
2. Browse for and select the entry representing the account.
3. The service account name appears under the sAMAccountName' attribute.
• Search Account Password: The password of the authentication Service account.
• Account Name Attribute: If the active tab isGeneric Directory,directory attribute to use for user account login inFME Flow. Typical attributes areUID,mail, orCN.
• Group Name Attribute: If the active tab isGeneric Directory,directory attribute to use for role name inFME Flow. A typical attribute isCN.
• User Class: If the active tab isGeneric Directory,objectClass属性值来标识用户目录。This value must be consistent for all users, as it is used to search for users in the authentication service. Typical attribute values areinetOrgPersonandorganizationalPerson.
• Group Class: If the active tab isGeneric Directory,objectClassattribute value that identifies directory groups. This value must be consistent for all groups, as it is used to search for groups in the authentication service. A typical attribute value isgroupOfNames.

Authentication

• Authentication Type: Specify the method of authenticating with the authentication Service:
• Basic: SASL authentication is not enabled.
• SASL: Enablessimple authentication and security level(SASL).
  • SASL Mechanism:
    • GSSAPI: Kerberos V5 authentication
    • GSS-SPNEGO: Simple and Protected GSSAPI Negotiation Mechanism
    • EXTERNAL: Context-implicit authentication
    • DIGEST-MD5: MD5 message digest
• Enable Single Sign-On: If the active tab isWindows Active Directory, this setting, if checked, allows users imported from this connection to auto-connect toFME Flowwith their Windows credentials.
Note  "> NoteTo use Single Sign-On, you must also update your Windows domain and web browser configurations. For more information, seeConfiguring Integrated Windows Authentication.
• Service Account Name: The name of the WindowsService Accountto configure for single sign on, in the formatUSERNAME(do not specify DOMAIN).
To get the Service Account name
1. FromAD Explorer, connect to the Active Directory.
2. Browse for and select the entry representing the account.
3. The service account name appears under the sAMAccountName' attribute.
• Service Account Password: The Windows service account password.

Optional fields

• Enable Synchronization: When checked, the connection synchronizes with the authentication service at specified intervals. Information that synchronizes includes:
• Relationships between users and groups. For example, consider User_1 who belongs to Group_1 inFME Flowbecause of a corresponding relationship in the authentication service. If that relationship is subsequently broken in the authentication service, the relationship between User_1 and Group_1 will break inFME Flowafter the next synchronization interval. Likewise, if an authentication service user changes groups, that change will synchronize inFME Flow.
• Name changes to user accounts on the directory server.
Note  "> NoteWhen synchronization occurs,FME Flow确保任何身份验证服务名称的改变es not break the user's connection toFME Flow. However,FME Flowdoes not update the user's login name (Username) or display name (Full Name).
Note  "> NoteIf Enable Synchronization is not checked, you can still synchronize the connection manually after it is created. For more information, seePerforming Other Tasks on Authentication Services Connections (Windows Active Directory, Other LDAP-based Directory, or Azure Active Directory).
• Synchronization Interval:Specify the desired frequency of synchronization.
• KDC Host: If the active tab isWindows Active DirectoryandSASL MechanismisGSSAPI, specify the host name or IP address of the Kerberos key distribution centre (KDC). If not specified, the KDC is assumed to be located on the same server as the Active Directory domain controller.
• Realm: If the active tab isWindows Active DirectoryandSASL MechanismisGSSAPIorDIGEST-MD5, specify theauthentication realmfor Kerberos V5 or MD5 message digest authentication. On Active Directory, the authentication realm is the domain name. Specify the capitalized version of the domain name, in its fully-qualified domain name (FQDN) form. For example, if the FQDN is domain.net, use DOMAIN.NET. If not specified, the authentication realm is assumed to be the domain name of the Active DirectoryDomain Controller.
Note  "> NoteIfHostis an IP address, you must specify aRealm.
To get the fully-qualified domain name (FQDN):
From a domain computer:
1. Open a command prompt (cmd.exe) via the Start menu.
2. Do either of the following:
   
   1. Typeecho %USERDNSDOMAIN%to display the USERDNSDOMAIN environment variable.
   2. The FQDN will print.

OR:

1. Typenet config workstationto display the network settings for the computer.
2. The FQDN appears under the 'Workstation Domain DNS Name' field.
From the domain controller:
1. Open 'Active Directory Domains and Trusts' from the Start menu.
2. In the console tree (left-hand column), a list of Windows domains are listed by their FQDNs.
• Search Bases: Specify the distinguished name of a section (sub-tree) of the authentication service that is accessible to the connection. Any sections not specified are not accessible. If not specified, the entire directory is accessible.
To get the distinguished name
1. FromAD Explorer, connect to the Active Directory.
2. Browse the directory to determine the location of all users and security groups to be provided access toFME Flow.
3. Select an entry to be used as the naming context.
4. The distinguished name appears under the 'distinguishedName' attribute.
• Alternate Servers: EnablesFME Flowto access the authentication service using alternateHostandPortcombinations. This setting may be useful in either of these situations:
• The authentication service can be accessed from multiple, redundant servers.FME Flowuses these servers to access the authentication service in a rotating manner, which distributes the load across them.
• If one authentication server is inaccessible,FME Flowconnects to one or more alternate servers.

To add aHostandPortcombination, click+.To remove aHostandPortcombination, click-.

• Account Name Attribute: If the active tab isWindows Active Directory,Active Directory attribute to use for user account login inFME Flow. For Windows, leave blank to use the account's pre-Windows 2000 login name (sAMAccountName).
• Account Member Attribute: If the active tab isGeneric Directory,authentication service attribute that contain a user account’s group membership. This attribute is not present in all authentication services. However, if present, it can make directory access more efficient. A typical attribute ismemberOf.
• Group Name Attribute: If the active tab isWindows Active Directory,attribute to use for the role name inFME Flow. For Windows, leave blank to use the group's pre-Windows 2000 group name (sAMAccountName).
• Full Name Attribute: The authentication service attribute to use for the user account’s full name inFME Flow. If the active tab is:
  • Windows Active Directory: Leave blank for Windows to usedisplayName.
  • Generic Directory: A typical attribute isdisplayName.
• Email Attribute: The authentication service attribute to use for user account's email address inFME Flow. If the active tab is:
  • Windows Active Directory: Leave blank for Windows to use the account's email address (mail).
  • Generic Directory: A typical attribute ismail.

When you import user accounts from an Azure AD server, your users can authenticate withFME Flowusing their Azure AD credentials when they:

• Log in directly toFME Flow.
• Publishworkspaces fromFME FormtoFME Flow, or authenticate in transformers, readers, or writers.
  Note  "> NoteAdditional configuration betweenFME Formand Azure AD is required. For more information, seeCreate anFME FlowAzure Active Directory Web Connection inFME Form.

开始

In order forFME Flowto communicate with Azure AD, you must create and registerFME Flowas an enterprise application in Azure AD. Follow the procedure inConfiguring Azure Active Directory with FME Flow. When finished, proceed as follows:

On theAuthentication Servicespage, ensure theAzure Active Directorytab is active, and clickNew. The Create New Azure AD Tenant page opens. Complete the fields below, then clickOK. When finished, proceed toAdding Users and Roles from an Authentication Services Connection.

• Name: Provide a name for the connection.
• Tenant ID: The Directory (tenant) ID that applies to theFME Flowregistration.
• Tenant Type: Whether the tenant for this connection is aPrimaryorSecondarytenant.Secondarycan be specified only ifFME Flowis registered in Azure AD to support multiple tenants. Additionally, both of the following conditions must be fulfilled in Azure AD:
  1. The tenant is granted secondary tenant access toFME Flow.
  2. FME Flowis granted access to the users and groups of the secondary tenant.

  For more information, seeGranting Secondary Tenant Access to FME Flow in Azure AD.

• Client ID: The Application (client) ID that was generated for theFME Flowregistration.
• Client Secret: The client secret value of the registered app. (The secret ID is not required.)
• Enable Synchronization: When checked, the connection synchronizes with the authentication service at specified intervals. Information that synchronizes includes:
• Relationships between users and groups. For example, consider User_1 who belongs to Group_1 inFME Flowbecause of a corresponding relationship in the authentication service. If that relationship is subsequently broken in the authentication service, the relationship between User_1 and Group_1 will break inFME Flowafter the next synchronization interval. Likewise, if an authentication service user changes groups, that change will synchronize inFME Flow.
• Name changes to user accounts on the directory server.
Note  "> NoteWhen synchronization occurs,FME Flow确保任何身份验证服务名称的改变es not break the user's connection toFME Flow. However,FME Flowdoes not update the user's login name (Username) or display name (Full Name).
Note  "> NoteIf Enable Synchronization is not checked, you can still synchronize the connection manually after it is created. For more information, seePerforming Other Tasks on Authentication Services Connections (Windows Active Directory, Other LDAP-based Directory, or Azure Active Directory).
• Synchronization Interval:Specify the desired frequency of synchronization.