Skip to main content

Open ideas have been reviewed by our Customer Success team and are open for commenting and voting.

1051 Ideas

OpenID Connect (OIDC) authentication support across the FME Platform - Have Your Say!Open

Hello FME Community 👋We at Safe Software are busy working on some exciting FME Platform enhancements, many focused on product security. We would like your thoughts on one of the ideas that is currently up for consideration.We’ve received previous requests to add OpenID Connect authentication support to FME Flow, and we think that OpenID Connect (OIDC) authentication could be supported broadly across both FME Form and FME Flow.So, before we dive right into development efforts on this idea, we’d like to know what you think about it! Would you benefit from the FME Platform supporting OpenID Connect (OIDC) authentication? If so, can you provide a brief description of how FME supporting OpenID Connect authentication would enhance your experience with the FME Platform? We are also looking for anyone who might be interested in testing out our implementation of OpenID Connect authentication, once available. If you would like to be included as an early tester, please indicate that interest in your response!Here’s a bit of background on OpenID Connect (OIDC) authentication. If you’ve ever tried to create an account with a new app you’ve downloaded, you might be presented with options to use another account (like Google or Facebook) to login to the new app. In this way, you can use an account you already have, instead of creating a new account. This is OIDC authentication at work, and can be considered an extension to the OAuth 2.0 protocol already supported across the FME Platform. More information on OpenID Connect (OIDC) authentication can be found by visiting the OpenID Foundation’s How OpenID Connect Works page. We look forward to hearing from you on this exciting idea! 

davisblack
Contributor
davisblackContributor

FME Flow User Role Security EnhancementsOpen

The following improvements to Role Based Security would be useful:1.Increased Granularity for Job Viewing and Job Management PermissionsI need the ability to allow users to see specific other user’s jobs and logs rather than all jobs and logs. We use different service accounts for different enterprise projects and currently I am having to share all jobs/logs with users so they can monitor their processes. Since not all groups need to see each other’s jobs this is not the best solution. (Thank you Safe for new search options in 2019 as they slightly help with this issue.)Likewise, in the current Role system being able to view all jobs requires job management permissions which let users cancel jobs in the queue or terminate running jobs. This puts me in a difficult position regarding how we implement SOX compliance. It is preferred users be locked out from managing running production processes. If the ability to view all logs but not manage jobs was made available that would be a move in a positive direction. If the option to say kill queued jobs but not running jobs was an option that may also be useful.2. Additional Options on Database ConnectionsHaving a Read option alongside the Full Control option for database connections would be excellent. I am seeing issues when I grant users access to connections without giving them full control over a connection. Since we have many processes using the same named database connection it is not ideal to grant users management access since one incorrect change by any user with access could disrupt jobs for all users using the connection. Something similar to how the Notification items are broken out would be amazing.3. Automatic Content Sharing with Administrator AccountsIt would be helpful if FME Server automatically shared user created content with members of the Super User role. If this could be an option for the FME Admin role that would also be appreciated. I have a plethora of users creating content and when they ask for help it is cumbersome to have to share their content with myself and my fellow Admins before I can help troubleshoot.