Security

Since upgrading from FME Flow 2025.2 to 2026.2, we are seeing a recurring authentication problem with our Workspace Apps. When a user opens or reloads an app, a native browser Basic Authentication popup appears intermittently, roughly every second or third load. Because we use SAML, our users have no local username or password to enter and are forced to click Cancel every time. After cancelling, the app works normally, but the repeated prompt is disruptive for end users.Our setup: FME Flow runs under HTTP behind an IIS reverse proxy (Application Request Routing) that enforces HTTPS. Authentication is handled through SAML with Azure AD as the identity provider using SP initiated login. On IIS, only Anonymous Authentication is enabled while Windows and Basic Authentication are disabled, and the SAML base URL is correctly configured.Using the browser developer tools, I captured the exact request that returns the 401. It is a GET to the Data Upload Service that the app fires in the backgro

Like the title says, whenever I try to publish a workspace with a sharepoint connector webservice to fme flow, I get below message. I have no problem writing to the same repository if I don't have sharepoint connector webservice in my workspace. Moreover I have no problem using the sharepoint connector webservice local on my fme form. Does anyone might have ideas why I get this error when trying to publish the sharepoint connector webservice to fme flow? 

I need to change the ownership of some workspace apps to another user. The reason is that the user has left the company, the user does not exist in EntraID anymore and the ownership has to be transfered to another user.Through the UI I cannot alter the ownership, so I have been trying to do it through REST.using {{baseUrl}}/fmeapiv4/apps/workspaces/{{appId}}I can execute a PUT with adjustments to “owner” and “ownerID”. The request executes with code 204 (No Content).However, a subsequent GET request using the same url as I used for the PUT request returns the data for the app untouched and the old owner remains. So does the ownerID.Is there any possibility for me to transfer ownership of a workspace app to another user?

I understand there are 4 cadence releases per year, for example 2026.1.0 and then 2026.2 through to 2026.4 by the year end.2026.1 is the first release of 2026. Instead of starting at xxxx.0, it starts at xxxx.12026.2.0 (Major) 2026.2.1 (Update) 2026.2.2 (Update) 2026.3.0 (Major) 2026.3.1 (Update) 2026.3.2 (Update) 2026.4.0 (Major) 2026.4.1 (Update) 2026.4.2 (Update) My question is to a Safer is not about the major releases, rather regarding these updates.Can you simply install as a patch over the existing major, or is it a full install, 2026.1.2 sure appears to be full install media?Where is the documentation for installing patch hot fix to the existing flow installation directory? 

Hello, We recently updated FME-flow to 2025.2.4. Shortly after we’re not able to publish workspaces from FME-form (2025.2) to Flow with the message ‘User is not authorized.’ while I use a superuser account. I cannot find something related in the User Management section on FME-form. Or might it also be something related on the server it is installed?If someone has tips or knows more about this issue that would be greatly appreciated.  

Hello Community,I am struggling with FMEFlowJobSubmitter transformer in FME 2026 and am leaning on the community to help me figure the problem out.I have a workspace that runs a child workspace using WorkspaceRunner locally or FMEFlowJobSubmitter on FME Flow. It worked perfectly well on FME 2024.1. Recently, we upgraded to 2026.1 and the workspace started failing on FME Flow. It looks like the workspace fails to run the child workspace.Now, when I open my main workspace with 2026.1 FME Form and get to FMEFlowJobSubmitter parameters, I get an error message in the log:This is the whole experience:What I’ve checked/done so far:Both, FMEFlowJobSubmitter from 2024 and FMEFlowJobSubmitter from 2026, throw the same error in 2026 FME Form. I am fmesuperuser and fmeadmin, i.e. my privileges are quite extensive. Users were restored from backup after FME Flow upgrade, so technically there should be no changes in access privileges I checked Items and didn’t find anything that would feel related to

I am logging in  FME FLOW on our local FME Server (v25.2.1) using my AD Credentials that I manually enter.  When I get logged in, I try to open several workbenches that I had previously uploaded and to which I had full access. However, I get a popup message “Unauthorized request by user (myaccountname) due to lack of proper permissions or the object does not exist.”I contacted the local FME administrator who advised that my account had full permissions to the workbenches I was trying to access.  He advised I log off and back in several times, the implication that he was reviewing or changing something on his end.  And always the same resulting error message.The administrator is adamant that I should be able to access the workbenches, however, I cannot.I had asked that the issue be escalated but the administrator was unsure where to escalate the issue.I am looking for any advice on the issue.Thanks in advance

Hello!After an update from FME-flow 2024 to 2025 and after the update some roles are not able to open the repositories under workspaces. They get the message ‘Unauthorized request by user <user> due to lack of proper permissions or the object does not exist’. I'm a superuser and able to open the repositories. Is there a new option under User Management I'm not aware of? Or does someone know a solution?

Hi there,In this article (Configure user attribute mapping with Azure AD SAML Provider – FME Support Center), a group claim can be setup to pass an AD group name which aligns to a role in FME Flow. As a group claim could be based on a search criterion and many AD groups could be returned which is a common method of Enterprise group membership in ArcGIS Enterprise software. I was wondering if this could be used to grant several roles to a user?Looking at controlling access to repositories, who can view workspace and who can run a job, etc via AD group assignment.Thanks

Good afternoon fellow FME enthousiasts,I'm struggling with the following. I'm trying to set up the System Email settings on our FME Flow to allow users to request a password reset. It all seems pretty straightforward but can't get it to work. Maybe i'm missing something though (it is friday afternoon after all). I've set it up as follows: But when i validate it I get the error:“Due to a configuration change made by your administrator or because you moved to a new location you must use multi factor authentication to access…...” Emails through emailers in workspaces ran on flow work like a charm, but this one keeps evading me. Any help would be appreciated.

HiWe are currently using FME Server 2021.2.1 on one of our servers, and we have identified a security vulnerability in this version. We would like to know if there are any available patches to resolve this issue. Please note that our ArcGIS Enterprise version is 10.9.1. We are concerned that upgrading FME Server to a newer version may cause compatibility issues with our current ArcGIS environment. Could someone please advise on the best way to solve this issue?

Hi,In articles such as this: https://support.safe.com/hc/en-us/articles/25407440139533-How-to-Create-a-SharePoint-Single-Tenant-Web-Connection-for-FME-Flow the workflow for publishing web connections with delegated permissions is to upload to Flow, and then modify the underlying Web Service. However, if FME Flow is set to be the connection storage, then that Web Service will be modified for Form as well as Flow.I am wondering how to manage this? Should I create two web services and web connections and upload both to Flow, then edit the Flow version to include the client secret? Then we would need to develop the workspace in Form using the Form specific connection, and then switch to the Flow version before publishing?It would be good to get some guidance on best practice for this.Thanks,Marc

 Since using FME Flow version 2024.2.3, running on Windows Server 2022. we face the following issues.BackgroundWe found that in FME Flow 2024.2.3 the network security protocol TLS1.3 is not configured by default. We expect it to work, see e.g. FME Community TLSv1.3 Support).  Also, for TLSv1.3, the minimum requirements for the versions of OpenSSL and Java used are:Tomcat 9.0.13 and later versions have built-in TLS 1.3 support For TLS 1.3 support, you need JDK 1.8.0_170 or later.As FME Support Third Party Component Versions reports, FME Flow 2024.2.3 uses Tomcat 9.0.91 and Java JDK 17.0.12+7.Actions First step: We enabled TLSv1.3 on our Server, by including the following keys in the Windows Registry: Windows Registry Editor Version 5.00 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server "Enabled"=dword:00000001 "DisabledByDefa

Hi all, I’m trying to connect to an SFTP operated by one of our vendors with an Automation Action but when trying to connect it just gives me an ‘Algorithm negotiation failed’ error with no other output.This page (FME Flow Troubleshooting: Automations – FME Support Center) says it’s an issue with the key exchange or host key algorithms not matching. They seem to have overlapping algorithms but I’m not sure how to definitively check what FME is using. Anyone had this issue? 

Apparently since fixing this problem https://support.safe.com/hc/en-us/articles/25407612007949-Known-Issue-FME-Flow-Apache-Tomcat-Vulnerability-with-X-Frame-Options-headerIn FME Flow 2025.1, embedding FME Flow content to other pages is disabled entirely by default.  Is there any chance to allow embedding from known sources or is embedding considered so risky that this would not be even considered? 

I just had to downgrade a local testing FME Flow (from 2025.2 to 2025.1.2) to solve some unforeseen breaking changes in 2025.2 (or probably in 2025.1.3).But now I cannot install a backups from 2025.2 into the 2025.1.2 Flow:I’m very sure that the backups does not contain anything that’s not workable in 2025.1.2, so it’s just a matter of administratively blocking the restore.Why is this versioning stonewalling necessary at all ?Why not just warn about potential problems and restore what can be restored ?

Hello,Our FME Flow server is installed behind a secure proxy and is accessible via the following URL: **[https://my.domaine.be](https://my.domaine.be)**The FME Flow server itself is *not* running in HTTPS; the HTTPS layer is configured at the proxy level.However, in the FME Flow configuration through the Web interface (Admin → System Configuration → Network & Email → Services), we have properly updated all URLs so that the root is **[https://my.domaine.be/](https://my.domaine.be/)**, and in “standard” usage everything works correctly with HTTPS URLs (access to the FME Flow web interface, data downloads, application publication, Webhook exposure).However, we are unable to use the REST API because an issue remains (see image in this email):FME seems to expect its API to be contacted over HTTP (see image in this email), whereas we must absolutely communicate with **my.domaine.be** over HTTPS.Could you tell us what needs to be adjusted in our configuration—whether at the proxy level (s

I’m working with FME Flow 2025 and I’ve built a Flow App that allows users to run a workspace by clicking a “Run” button.My concern is about system overload: if a user (maliciously or accidentally) clicks the “Run” button hundreds or thousands of times, this could flood the job queue and potentially saturate the single engine I have available.I’ve looked into Job Queues and Job Routing Rules, but they only let me set priorities and routing conditions (repository). I understand that jobs can be routed to different engines using queues, but that’s not my goal. My goal is to limit the number of jobs submitted by users, not to distribute them across multiple engines.What I’m trying to achieve is: Prevent users from creating an infinite queue of jobs. Ideally, enforce a limit per user (e.g., max 5 jobs active or queued). Any ideas?

Hi,I’m using the FME Server API to perform an audit and cleanup. I can use the API to retrieve lists of users, workspaces, and workbenches. Separately, I can also get a list of connections.I want to check if any of these connections are now redundant after the recent cleanup. Is there a way to link connection names to the workbenches they are used in, so I can identify and remove unused connections?I can’t see a way to do this via the API. The only approach I can think of is to download all the .fmw files and then read them in FME Desktop using the .fmw reader.Any help or alternative suggestions would be appreciated, ideally all within the api.Thanks!!

Hi,I have a unique situation where my org can’t connect to Flow from Form desktop.Some background first.We are hosting our own server with Flow 2025.0, and Form to match.For several months now we have been using Microsoft Azure to login to Flow, and to also connect via Form using the same authentication method.  The Azure login to Flow via the web GUI still works without any issue.  Visiting the Manage Web Services options, the web service that was built using the MS Azure Active Directory template authenticates fine using the “Test” option so proper communication is occurring between the Microsoft tenant and our Flow server.Our IT department recently upgraded the GIS team to Windows 11 and since then we’ve experienced problems.Within Form, using the admin account with a password still works and we can carry on publishing.However, trying to connect via Azure is giving us fits.   Any attempt to create a new connection to Flow results in the following error message - “Request to update a

I see a description of the FME_SERVER_WEB_URL in documentation. Question: What does it do? With a setup that has a proxy server that relays requests to the FME Flow server via URL ReWrite and ARR, a flawed web-hook request (e.g., a parameter name address is given to a web hook that doesn’t have an address parameter) causes an error message to be returned to client--with details such as the internal server name (as set by FME_SERVER_WEB_URL, which is set to the internal server out-of-the-box) and the FME Flow username of user who published workspace. I understand changing service URLs for this sort of setup; that seems to be how the client knows how to download/stream the result. But FME_SERVER_WEB_URL seems to be more for just info provision (logging, etc.). What if I don’t want the FME_SERVER_WEB_URL parameter to show the internal server name in error messages from bad web-hook requests?

We are upgrading to FME Flow 2024 and wanting to make some improvements. As part of this we want to know if we can have a user upload workbenches to FME Flow. Then login to FME Flow with their user account, but somehow build automations, streams, apps, and scheduled jobs to run under a different user account. We are trying to migrate from putting the all the running automations, schedules, and other items under individual user accounts. Instead we want to assign to a departmental account. Since we have FME Flow tied into our Active Directory this will prevent any permission issues of jobs not working when an employee leaves the company and their AD account is suspended. I didn’t really want to have every user login to FME Flow with the departmental user account. Then we won’t keep the individual repositories for workspaces and will become a mess. I know the GUI/Web Front End as-is doesn’t support this but trying to decide what approach I could do to solve this.My easiest thought is to

For those who have a connection setup to use a SharepointOnlineConnector in FME Flow. If you’re running 2024.1 or above, have you changed to use Application permissions with a tenant id, client id and client secret rather than using a delegated permission and authenticating with a username and password? Any issues with updating?

Hi, Looking to call a PowerShell script that will need to be run as a different user to the service account that runs the FME Flow service.FME Flow is a shared server and these credentials need to be secure from other users scheduling flows.I could use an encrypted xml file for the credentials, but then all who use the server would have access via the FME Flow service account. Putting the password in the workspace as a password, I still see it in plain text.While these work and I can make the exposure risk lower, still don’t seem ideal,What are my other options?