Active Directory connect with group managed service account (gMSA) possible?

Hi @wicki,

Great question. Here is what we know:

• FME Server will run when the services are run under a Group Managed Service Account.
• Using a GMSA as the "Search Account Name" for Active Directory Connection has not bee tested.
• Nor has adding GMSA's to FME Server users been tested.

Thanks,

Richard

Hi @richardatsafe,

thanks for your answer.

Will you test using the gmsa as the "search account"? That's the interesting point for me. If that is supported by FME SERVER it would be really great.

Otherwise have to change the password manually every day. That would be a no go for using AD with the FME Server.

Hi @wicki,

Testing showed that at this point they do not work. I created a change request for adding this support, but if its something that is very important please post it on our ideas page so we can get more traction.

• Using a GMSA as the "Search Account Name" for Active Directory Connection
• or importing GMSA's to FME Server users.

Hi, @richardatsafe​ 

Have this change request had any progress? I'm sitting in an organisation that wish to use gMSA. :)

Hi @worjak​ ,

GMSA works perfectly fine as the service account running FMEServer (core,web, engines). Do you have a specific need outside of this for using the GMSA account such as an LDAP connection search account?

True, the GMSA runs the FMEServer (core,web, engines) fine, but we have difficulties using it to connect to ms sql server via windows authentication/SSO? I'm surprised that we get these problems since we had succes doing the same with a non-GMSA. I understand a benefit from using the GMSA is to avoid renewing a password.

Thanks @worjak​, That's something we had not considered, I will make a format enhancement to see if we can make the readers / writers use GMSA? Are there any other formats you would like to use this way?

That's great @richardatsafe​  - I dont' have anything to add at this point .

Hi @worjak​ ,

I'm looping back to this for some general testing, but it looks like GMSA are not meant to be used as user database logins only for running the services, and I could not find a working method for creating GMSA user login for the MSSQL database. Would you have a method for this?

Hi @richardatsafe​ ,

Any news on this? We have encounted the same issue and our organization uses gMSA-accounts only, including database connections. Other applications can connect with gMSA-account to SQL databases without any problems, but no luck with FME Flow.

Could not open the Enterprise Geodatabase. The error number from ArcObjects is: '-2147216118'. The error message from ArcObjects is: {Bad login user[ ]}

Hi @marty​ ,

There hasn't been any development to enable Active Directory Connections to use GMSA yet, but I can add your comment to the issue if you require this functionality. As far as using it in the GMSA service account to run the engines, this works fine. However using a reader that uses Integrated Windows Authentication (which I am assuming you are doing) for the GMSA often has issues as a lot of databases don't support GMSA logins. Can you confirm in another way otehr than FME that using the SDE file as the GMSA works? I should note there are a couple of reasons for your error, and if you can create a case so we can dive into the details of your environment and set up we may be able to either help or create a better enhancement request.