Question

Running FME Server instance using an AD account to access UNC path

  • 29 March 2018
  • 4 replies
  • 11 views
R

Hi experts,

I am currently looking at allowing my FME server jobs to write data into an access controlled UNC path.

I had looked at the following documentations on the changing of the "user account" that is running the FME server instance.http://docs.safe.com/fme/2017.1/html/FME_Server_Documentation/Content/ReferenceManual/Directory-Account-Permissions.htm

http://docs.safe.com/fme/2017.1/html/FME_Server_Documentation/Content/AdminGuide/Running_FME_Server_Engines_Under_Different_Account.htm

The question is, in order for the FME server to function correctly, do I need to change the "user account" used to run the FME windows services for all the 4 services?

FME Server Core

FME Server Database

FME Server Web Application

FME Server Database

Or will the changing of the "user account" used to run the FME Server Core will allow my jobs to write to a controlled UNC path with breaking any other connection?

 

Thanks!

4 replies

richardatsafe
Rank
Badge +10

Hi @rongjun,

Great questions. In order for you to write to the UNC path you will need at least the FME_Engine and FME_Web Application to be run under that account. Its usually best practice to change the core as well, but the engines and web services are they key players.

R

Hi @RichardAtSafe, thanks for the answer. Just to check, what is the implementations of changing or not changing the core?

I did a test of just changing the core without changing the engine and the web application. My FME jobs seems to be able to read the UNC path as well.

On a side note, why is it not required for the database to be changed as well?

Thanks.

richardatsafe
Rank
Badge +10

Hi @RichardAtSafe, thanks for the answer. Just to check, what is the implementations of changing or not changing the core?

I did a test of just changing the core without changing the engine and the web application. My FME jobs seems to be able to read the UNC path as well.

On a side note, why is it not required for the database to be changed as well?

Thanks.

The FME Server Core manages job requests, scheduling, services, and repository contents. So if your data is in a UNC which is an FME resource then the core would need permission or if the UNC is being used by a notification service like directory watch then the core needs permission. The engine is what processes the workspace though. So usually it requires access to where the data is read and written.

 

The database does not run any process and only connects to the engines and core. So as long as the engine service can connect to the core/engines, and vice-versa, it's not necessary to change it. In a distributed environment though we recommend changing all the services to the same service account.

 

That being said I'm not clear on why just the core seemed to resolve your issue. Usually that would indicate that the core couldn't connect to the engine.

 

 

Thanks,
sunsilk11
Rank
Badge +6

@RichardAtSafe

Hi Richard, I have provided full access to the FME Server install folder and the shared folder and also

the UNC path.

I am running all the FME services as the same service account. However, this is still not working.

If I change the service account to my own account, it works fine.

see log attached.

Any ideas ?

 

fmeserverlog.txt

Reply


Community Stats

28,665
Posts
109,338
Replies
36,534
Members
Terms & ConditionsCookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.