- - Community Resources
Ideas
Product Updates
Events
Blog

Home
Forums
FME Flow
Security

Security

Permissions, roles, and administration. Security in data processing.

137 Posts
413 Replies

When you subscribe we will email you when there is a new topic in this category

137 Posts

mgg_becaContributor

List all disabled FME Flow users

Hi, I would like to list all FME Flow users that are currently disabled using the rest API or any other method. Is this possible? Thanks,Marc

1 year ago

jambrogiContributor

asked in Security

Can FME Server 2019.1 continue running without log4j and Apache Tomcat being installed?

A recent vulnerability scan where i work identified both Log 4j and Apache TomCat vulnerabilities with our FME Server applications. I am currently running FME Server 2019.1, I know that particular version of FME does not utilize Log4j , but the files exist as a part of the installation. Can we simply mitigate these vulnerabilities by removing the log4j and TomCat installation, or do we need to upgrade those install to a more current version? If we install newer versions of both log4j & TomCat will the FME Server 2019.1 application continue to function as expected?

350

1 year ago

edwibberleyContributor

asked in Security

Is it possible to make a HTTP call with a Content-Transfer-Encoding header?

We have a series of API calls to a Bentley API which have been working fine until recently and are still working fine in Postman. We have a GET request in FME which returns a “HTTP/1.1 403 Forbidden” error. We have been through this with Bentley support and have found the source of the issue is related to the Content-Transfer-Encoding header. Bentley's API’s security rules have recently been updated to block requests which contain the ‘Content-Transfer-Encoding’ header. This is because the header has been deprecated and has the potential to be a security vulnerability. FME seems to default send "Content-Transfer-Encoding: binary" with the GET request and there doesn't appear to be an option to change it. Does anyone have any ideas about how we can get round this? Thanks in advance!

Esri Geodatabase (File Geodb),无法读取

开始转换...行“已卸载包 '%0'”在消息文件“C：\\Program Files\\FME\\messages\\zh\\fmemessages_zh.fms”中没有分隔符“，”FME 2023.0.0.3（20230613 - 内部版本 23319 - WIN64）FME表格固定（节点锁定-crc）临时许可证：剩余 28 天。计算机主机名为：ss操作系统：Microsoft Windows 10 64 位（内部版本 18363）版权所有（c） 1994 - 2023，安全软件公司。安全软件公司246020 格式的共享文件夹是： FME 2023.0.0.3 （20230613 - 内部版本 23319 - WIN64）246022 坐标系共享文件夹是 : 20230827005921246012 FME_HOME是'C：\\Program Files\\FME\\'FME表格固定（节点锁定-crc）246013 坐标系共享文件夹异常 : 0临时许可证：剩余 28 天。计算机主机名为：ss246026 场所：zh_CN246024 操作系统区域设置编码：GBK246027 系统编码： UTF-8246034 FME API 版本：“4.0 20230418”246017 FME配置： FME_BASE 是 'no'246016 操作系统：Microsoft Windows 10 64 位（内部版本 18363）246025 FME平台：WIN64246014 系统状态：FME临时文件夹下还有 80.88 GB硬盘空间可用246001 系统状态：15.99 GB 可用物理内存246015 系统状态： 63.97 GB 可用的虚拟内存246031开始 - 进程 ID： 1976，峰值进程内存使用： 43264 kB，当前进程内存使用： 43264 kB871015 创建该格式的读模块： Esri 地理数据库（文件 Geodb）871007 尝试查询一个DYNAMIC插件给命名的读模块'GEODATABASE_FILE'23016 加载模块'GEODATABASE_FILE'从文件'C：\\Program Files\\FME\\plugins/..\\地理数据库9.dl

Is there any way to encrypt file in PGP in FME?

230

1 year ago

redgeographicsCelebrity

asked in Security

Disable browse resources option in Server App

I'm working on a server app where users have to upload a photo taken with their phone. There's no need for them to browse the resource folders and so I've disabled access to the resources for that security token (except write access for the temporary folder where the images are stored). However, the users still have the option to browse the resource system: Ideally I'd want that "Browse resources" button to be gone and just have "Upload file". Is there any way to do that (other than write an app of my own)?

Hi, I get an error message because of a permission. Had anyone a similar error?

Error executing SQL command ('TRUNCATE TABLE "quali"."wa_hydrant"'): 'ERROR: permission denied for table wa_hydrant'Error truncating table 'quali.wa_hydrant'. Assuming table exists and attempting to appendError executing SQL command ('COPY "quali"."wa_hydrant" ("gis_id", "gesellschaft_bd", "gemeinde", "standortwerk", "_rbe", "_fehler_nr", "_fehler", "_pruefdatum", "_fme_prozess", "_temptext1", "_temptext2", "_temptext3", "_temptext4", "_temptext5", "_temptext6", "_temp_num1", "_temp_num2", "_temp_num3", "_temp_num4", "_temp_num5", "_temp_num6", "fstatus_id", "geom_pt") FROM STDIN USING DELIMITERS ':' WITH NULL AS 'NULL''): 'ERROR: current transaction is aborted, command

580

1 year ago

bretrContributor

asked in Security

Using HTTPCaller POST to get Security Token

I am having problems trying to do the above. Documentation for the token request is here: https://bitbucket.org/ikegps/office-api/src/master/ It is requiring a application/x-www-form-urlencoded content-type. I have setup the HTTPCaller like this: The 'mulitpart' upload also includes the additional fields from their doc for 'audience', 'username' and 'password'. I used the example Curl command in Windows list on their docs and was able to get a token. I am getting a '401 error' running this in a workspace. Any help on this or suggestions would be greatly appreciated. I have been fighting with it for a while, and have searched for examples/help here, but haven't gotten it to work.

I got an error in starting FME workbench 2022.2.5 after windows 11 update

FMEworkbench wil not start after an update from Windows 11 last week.It starts with the start-screen but after "Initializing main window" stops the startup I'm working with version 2022.2.5 build 22795 I got the details in the following errorlog (in dutch):Logboeknaam: ApplicationBron: Application ErrorDatum: 12-5-2023 10:19:51Gebeurtenis-id:1000Taakcategorie: Toepassingscrash-gebeurtenissenNiveau: FoutTrefwoorden: Gebruiker: Computer: Beschrijving:Naam van toepassing met fout: fmeworkbench.exe, versie: 2022.7.45.22795, tijdstempel: 0x6424fcdcNaam van module met fout: Qt6WebEngineCore_fme.dll, versie: 6.2.4.0, tijdstempel: 0x625ef5dcUitzonderingscode: 0x80000003Foutmarge: 0x0000000002645d96Id van proces met fout: 0x0x4388Starttijd van toepassing met fout: 0x0x1D984AA82E9B0ABPad naar toepassing met fout: C:\\Program Files\\FME\\fmeworkbench.exePad naar module met fout: C:\\Program Files\\FME\\Qt6WebEngineCore_fme.dllRapport-id: feefc3f6-3f26-44

1210

1 year ago

sigtillContributor

asked in Security

Connecting FME Flow to Azure AD

When connecting FME Flow to Azure (Configuring Azure Active Directory with FME Server (safe.com) - the app needs permission to:Microsoft Graph > Application permissions > Group.Read.All, User.Read.AllMicrosoft Graph > Delegated permissions > User.Read However when using Azure AD and FME Form the following permissions are needed: Microsoft Graph User.Read Delegated Is it possible to limit the FME Flow permissions to be the same as FME Desktop - or is there a reason you also need Group.Read.All and User.Read.All ?

190

1 year ago

annette2Contributor

asked in Security

checking for a (security) hotfix / patch or upgrade recommendation

We have processes in place for ArcGIS Enterprise patching but none for FME Server. Occasionally there is a hotfix that is released that is security related. Or last month there was an update from our vendor on their website related to CVEs and upgrading. Is there a central place that we can get this information from? Preferably without having to do a manual check on a website page etc. I have signed up our support email to the Stay Informed email list on safe.com/downloads. Would this email list suffice or are there any other feeds that we could check in relation to security patches?

Force OAuth2 Connections on HTTP POST method

Hi, I am trying to connecto to an API that supports only POST method to generate the tokens via OAuth2. After some testing and fiddling, I can see that FME Desktop (2022.2) sends first a GET request when trying to get the token. So this request is declined by the server and I cannot continue further. Is there a way to enforce POST for the whole OAuth2 flow in Desktop/Server?

1 year ago

brianapeters

asked in Security

keytool error: java.lang.exception: failed to establish chain from reply

When importing the certificate i get this error? Has anyone had this happen and what was their resolution?

240

1 year ago

redgeographicsCelebrity

asked in Security

FME Hub items and security

I'm wondering to what degree items uploaded to FME Hub are checked? Are they considered "safe to download" or "use at your own risk"? Imagine a wild scenario where I would upload a custom transformer with a SystemCaller in it that formats the c drive, will that get flagged or not? (and what if I password-protect it?)

710

1 year ago

zzupljaninContributor

asked in Security

License Generator

Hi, Where can I download License Generator that I need to use for my LicenseChecker?

How can I extract User Name from FME Database Connections?

Hello, I am trying to collect and maintain some metadata for FME Workbench, which includes the database connections attributes that each of our workbenches (.fmw files) use. We are currently using FME Desktop 2021.2 on Windows. So far, I have extracted the Database Connection information from the fme_connections.data file using a SQLite transformer. However, many of the values including User_Name are encrypted (fme_enc2). I realize I am stepping into the realm of security and cryptography - and also realize that if I gain access to the user names, I will be able to apply the same principles to passwords and other sensitive data in the Database Connections - and absolutely respect the principle of protecting secrets. That said, I am an FME administrator for my organization, and have access to both the fme_publicKey and fme_privateKey files - and am really only interested in the User Names associated with the connections. If there is a better way to collect that information than b

1100

1 year ago

jfisch25Contributor

asked in Security

Mixed Success Connecting to Floating License Server

I know there is a lot of content covering this topic already, so I'll preface this by saying I have looked through it. I looked at the floating license server troubleshooting article here and the article about serving both ArcGIS and Safe licenses here and I have run the diagnostic .bat file. My issue is this: I can connect to the floating license server without issue, but one colleague can't connect at all, and another one can connect intermittently but always seems to encounter a similar issue to the one who can't connect at all. SETUPec2 instance in AWS behind a network load balancer, with both ArcGIS License Manager 2021.1 and Flexera 11.16.2 installed. The license files for both are stored in the "License" folder for ArcGIS, and each license file specifies a unique port to use (ArcGIS Vendor: 27009, Safe Vendor: 27002). Instance firewall has ports 27000-27009 open and security group settings allowing traffic on those ports from our specific office IP's. T

Hi. Our security team informed us that some files of the FlexNet License Server were flagged by our virus scanner and were marked as maleware. Can anyone confirm these files really belong to the FlexNet License Server ?

The following files were detected as maleware:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlexNet for Safe Software\restartService.batC:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlexNet for Safe Software\Start - Restart FME License Server.lnkC:\Program Files\FlexServer\BatchFiles\restartService.bat

Connect to Mapillary API

Hi, I have tried to follow the suggestions in this thread to connect to Mapillary API without success.https://community.safe.com/s/question/0D54Q00008vZLePSAW/hi-have-anybody-succeeded-in-connecting-the-mapillary-api-v4-with-fme-workbench-i-get-stuck-on-an-internal-server-error-when-i-use-httpslocalhost-as-redirect-url-in-the-oauth-20-webservice-authentification I am using these settings:I am just getting a login page when I test the service: Any suggestions? The result is the same with http://localhost and https://localhost. It is the same when adding Authorization under HTTP Header for Retrieve Token Parameters. Anyone got any suggestions on how to connect to the API and for example get coverage tiles.

690

2 years ago

defence_hyangParticipant

asked in Security

Internal web site does not have certificate. how to bypass the step to upload Base-64 encoded X.509 (.CER) and local PFX cert directly?

Hi,My organisation provided me a CA signed PFX certificate.I have followed the step-by-step guide to update server.xml, web.xml and content.xml, etc.I am able to restart the FME server service.However, when I use https://locahost/ or https://<server name>/fmeserver/I contantly get the message "This is site can't provide a secure connection", and ERR_SSL_PROTOCOL_ERROR.click the (i) at the URL address bar shows NO certificate.I checked the other internal site, it states "This site does not have certificate."I couldn't complete the export and import Base-64 encoded X.509 cer file.How can I move forward from here to complete the HTTPS enabling?ThanksHelen

510

2 years ago

mgg_becaContributor

asked in Security

How to count the number of roles a user is assigned to using FME and the REST API?

Hi there, I am trying to use FME to automate some user management for FME Server. Specifically I would like to schedule a workspace to remove any Azure users that are not members of a role. I have worked out how to list the users and get their roles, but I can't work out how to go from this json array: ["user:admin","fmeadmin","fmesuperuser"] to the integer value 2. Can anyone please help me drop the "user:..." part from the array and count the number of items that are left over? Thanks!Marc

XMLFragmenter - How to expose only the first attribute

Hi, I am trying to expose an attribute from the _response_body returned from a http caller. This is the response: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2022-11-24T11:20:34.572Z</u:Created><u:Expires>2022-11-24T11:25:34.572Z</u:Expires></u:Timestamp></o:Security></s:Header><s:Body><CreateWorksheetResponse xmlns="http://webservices.whitespacews.com/"><CreateWorksheetResult xmlns:a="http://webservices.whitespacews.com/API/" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><CodeDescription>Success</CodeDescription><ErrorCode>

194

2 years ago

joySupporter

asked in Security

Does FME desktop 2021 make use of Apache Commons Text?

Hello everyone,In regards to the security issues in regards to Apache Text Commons 1.6 till 1.9, I was wondering whether FME dekstop makes use of this file and if yes, one needs to be worried about it?

2 years ago

fjanson

asked in Security

Problem with Azure AD guest users in FME authentication service

I have set up integration between FME Server (v2021.2.6) and Azure AD where I am able to import users from AAD and native AAD users are able to single sign in using microsoft. The problem is that Guest users in AAD are not able to single sign in using Microsoft login. It seems that the FME server logon instead tries to authenticate through the users home-tenant. Does anyone have experience with this setup?

210

2 years ago

jhawksContributor

asked in Security

Install/ connect to external Tomcat on an existing FME Server install?

Windows 2019/ FME Server 2022.0.2. We weary of doing full FME Server upgrades when all we really need to do is upgrade Tomcat for security vulnerabilities. TC is currently embedded in Server, can we install latest TC externally (on the server but not part of fme) and hook to that?

2 years ago

Page 3 / 6

Badge winners

gazmanhas earned the badge Welcome Back
miguelhacarhas earned the badge Spanish Speaker
miguelhacarhas earned the badge Student (Grey)
miguelhacarhas earned the badge Expert (Grey)
miguelhacarhas earned the badge Teacher (Grey)

Show all badges

30,351: Posts

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

An FME Account is required to contribute

Login to the community

An FME Account is required to contribute

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

A product of

Company Products Giving Back Careers Contact Privacy Feedback

Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.