FME Server Active Directory: Away from Distinguished Name (DN)

Please note that in FME Server 2020.0 we have made some improvements to this experience.

If there is a name change in Active Directory that affects a User Account imported to FME Server, previous to FME Server 2020.0 (Build 20163), that user would not be able to login.

Now, that user will still be able to login with the "original" username.

This comes with a few important details...

• the original User Account would need to be deleted and re-added to have the name updated in FME Server
• both User Accounts cannot exist at the same time
• synchronizing does not automatically update the username

Clear as mud? Let's try walking through an example....

1. John Doe is imported to FME Server through an Active Directory connection. He logs into FME Server as "jdoe" without any issues, using his network password.
2. John Doe changes his name to John Deer. Now his Active Directory username is "jdeer".
3. John Deer must continue to login to FME Server with the username "jdoe".
4. An FME Server Admin is unable to import "jdeer" to FME Server so long as the "jdoe" User Account exists on the same instance.

Please reach out if you have any questions or comments.

Thanks, can I ask what AD details it is looking at?

@todd_davis ObjectGUID. Research by our Development Team identified that this value should not change.

Noting that ObjectSID/SID was also considered, but the ObjectGUID seemed to provide more benefits. For example, the SID will change if a user changes domains (though is stored in SIDHistory), but the GUID value will remain the same.

Thanks...that's good to know, as someone is bound to ask me when I say it is changing for the better.

Very true! And I hope that we can resolve the caveats on the FME Server-side, that I noted in my comment. Currently, we run into complications with object-inheritance and the way UIDs for User Accounts are defined. (So that day will come where FME Server is more lenient on renaming objects itself...)