Security

I am using FME Flow 2021.  Is there a way to add Active Directory User Names and credentials into FME Flow? Sort of like SSL/SSO with ArcGIS Enterprise.  My goal would be to be able to use the same user credentials I use on our network for logging into FME Flow.  Currently, my FME Flow has a domain user name, but the user names in FME Flow are built in. 

We have successfully created a Web Connection for Microsoft SharePoint Online and had it authorise on FME Flow and workflows use a FeatureWriter to update list items in SharePoint.However, periodically (we suspect each day) an administrator will need to RDP to the server that hosts FME Flow, access the Web Application and Authorise the Web Connection otherwise workbenches error with the following message.2024-2-12 09:46:10 | Microsoft SharePoint List Writer: Client-side error: '401 Client Error: Unauthorized for url: URL' returned from SharePoint. Error message was: '' I have a suspicion that this is because as our FME Flow is hosted on-premise and is not configured for HTTPS. However, as the web connection maintains authorisation for a period of time I’m not 100% convinced.Has anybody experienced this behaviour in the past? How was it solved?We do have a ticket open with our infrastructure team to configure FME Flow for HTTPS and if this is the prime suspect then we can use this to pu

Hi!I would like to get all database connections and additional information (e.g host, service name, username etc ) from FME REST API. I know that I can get all database connections with this request:https://FMEServerName/fmerest/v3/security/categories/NamedConnections/resources?limit=-1&offset=-1 it gives owner, display name, permissions, name, but not connection parametes. Is it somehow possible to get connection parameters as well? Thanks!

While trying to download this file https://downloads.safe.com/fme/2023/win64/fme-form-2023.2.2-b23781-win-x64.exe trend apex one antivirus regards it as malware.

I upgraded my Development machine Thursday, and install ran smooth, import of backup ran smooth. Checked settings and all appear to match up with Staging and Production, but unable to get Single-Sign-On to function again. Negotiation reported an error: "Failure unspecified at GSS-API level (Mechanism level: Encryption type RC4 with HMAC is not supported/enabled)". All three of my systems use the same Service-Account, and Staging and Prod have not issue, and Dev worked fine until the upgrade.  

Hi all,What is the correct process to delete admins from FME Server. I deleted 3 fmeadmin users, testing before that any schedules or automations would be assigned to another user etc. Today many of our schedules who are owned by a completely different user are not working. They also don't work if I do a manual trigger. Recreating the schedule does work. Re-adding the user doesn't.  I see in the Completed jobs that the schedules that ran before I deleted user have a reference to a Deleted user. I think the only way to fix this is to manually try to trigger each of our 25 job and recreate the schedule on acceptance and production.  Any other ideas would be appreciated. And it would be interesting to know what is the correct procedure? Did I miss something? We are using Server 2021 but this server has been upgraded with an old backup since approx 2015 version.    

I have a workbench that reads/writes CSV files to a network location. It works fine from my desktop but when published to FME Flow i get permission errors reading and writing. What user is FME Flow using to read/write to the network? any other workaround

Is this a bug in FME Flow 2023.1 Build 23619 - win64?

I want to encrypt generated output shapefile via PGP encryption in FME. How we can achieve this?

We (APA) are facing issues with security certificate installed on our FME Server.The certificate has expired and we are not able to update it with new valid cert. We have followed the workflow mentioned here: https://community.safe.com/s/article/Configuring-FME-Server-for-HTTPS-Updating-an-expired-CertificateWe completed all these steps but still not successful.when we connect we still see old expired cert on browser.

I have an FME Server (Flow) 2022.2.5 installation on a Windows server and I have application-level user security enabled (not Windows-level security). Sometimes I need to do maintenance on the server and I'd like to be able to see who is currently logged in via the web interface. I've looked everywhere in the web interface for something like this but no luck. Thanks.

Are FME Desktop 2017 and 2020 vulnerable for Apache ActiveMQ CVE-2023-46604? Thank you

I have a private AWS server. I have a customer who uses power app to create rest api calls to fme server installed on this server. They need the server to be at a security level of https. They access fme server using the URL of the server through a gateway with an enabled port. Aws has its own security certificate but it charges a lot of money for a private CA. There are free websites out there but they want the domain registered. I can't register the domain of the AWS as it's a private server  I went through the safe http to https tutorial using a self signed cert (pfx) section. However, while I managed to get the fme server to use https an untrusted error comes up, even if I add the cert to trusted certificates. I suspect it's because it is a self signed cert. I've had to roll back fme server to http as the users couldn't access the rest API anymore.  This is my first dabble with security certificates but I can't see a solution around this. thanks for any adv

Is FME Server / Flow vulnerable for Apache ActiveMQ CVE-2023-46604 https://www.cve.org/CVERecord?id=CVE-2023-46604

Hi!We have configured FME Flow (2022.2.8) for OKTA SAML Authentication as per https://community.safe.com/s/article/Configuring-FME-Server-for-OKTA-SAML-Authentication On signing in with a username, password and MFA it redirects us back to the password page.The restV4.log or fmesaml.log never shows that we attempted to login. We tried to configure FME Flow for Azure AD SAML Authentication, but got the same outcome. Any ideas, please? Regards,Dmitry

I want to automate a rest call to the FME FLOW API for schedule information, like https://myfmeserver/fmerest/v3/schedules?includeAutomations=true&limit=1000&offset=0 What are the minimum FME permissions needed to be assigned to role or system user to be able to run that API call ?  

At the moment I get a token with a normal HTTPCaller with username and password as User parameters. However, I would like to store username and password secure. For this reason I tried to use a Web Connection. Unfortunately this didn't work. Any recommendation hwo this should be done? This is my HTTPCaller that works fine but with the drawback that username and password are defined as user parameters in plaintext.

How to enable anonymous access to FME Flow (2023) services? Guest account is enabled and given permissions on repository and services OK. Trying to call a service always prompts for credentials. Can login as Guest and it works so permissions are OK.

For an automation running on FME Flow is there a method save the parameters used to send an email? Currently we have many email services set up and are switching email servers around. It would be nice to be able to update the credentials for one source opposed to having to edit the parameters in each automation individually.

Hi, I would like to list all FME Flow users that are currently disabled using the rest API or any other method. Is this possible? Thanks,Marc

A recent vulnerability scan where i work identified both Log 4j and Apache TomCat vulnerabilities with our FME Server applications. I am currently running FME Server 2019.1, I know that particular version of FME does not utilize Log4j , but the files exist as a part of the installation.  Can we simply mitigate these vulnerabilities by removing the log4j and TomCat installation, or do we need to upgrade those install to a more current version? If we install newer versions of both log4j & TomCat will the FME Server 2019.1 application continue to function as expected?

We have a series of API calls to a Bentley API which have been working fine until recently and are still working fine in Postman. We have a GET request in FME which returns a  “HTTP/1.1 403 Forbidden” error.  We have been through this with Bentley support and have found the source of the issue is related to the Content-Transfer-Encoding header. Bentley's API’s security rules have recently been updated to block requests which contain the ‘Content-Transfer-Encoding’ header. This is because the header has been deprecated and has the potential to be a security vulnerability.  FME seems to default send "Content-Transfer-Encoding: binary" with the GET request and there doesn't appear to be an option to change it. Does anyone have any ideas about how we can get round this?  Thanks in advance!

开始转换...行“已卸载包 '%0'”在消息文件“C：\\Program Files\\FME\\messages\\zh\\fmemessages_zh.fms”中没有分隔符“，”FME 2023.0.0.3（20230613 - 内部版本 23319 - WIN64）FME表格固定（节点锁定-crc）临时许可证：剩余 28 天。计算机主机名为：ss操作系统：Microsoft Windows 10 64 位（内部版本 18363）版权所有 （c） 1994 - 2023，安全软件公司。安全软件公司246020 格式的共享文件夹是 ： FME 2023.0.0.3 （20230613 - 内部版本 23319 - WIN64）246022 坐标系共享文件夹是 : 20230827005921246012 FME_HOME是'C：\\Program Files\\FME\\'FME表格固定（节点锁定-crc）246013 坐标系共享文件夹异常 : 0临时许可证：剩余 28 天。计算机主机名为：ss246026 场所：zh_CN246024 操作系统区域设置编码：GBK246027 系统编码： UTF-8246034 FME API 版本：“4.0 20230418”246017 FME配置： FME_BASE 是 'no'246016 操作系统：Microsoft Windows 10 64 位 （内部版本 18363）246025 FME平台：WIN64246014 系统状态：FME临时文件夹下还有 80.88 GB硬盘空间可用246001 系统状态：15.99 GB 可用物理内存246015 系统状态： 63.97 GB 可用的虚拟内存246031开始 - 进程 ID： 1976， 峰值进程内存使用： 43264 kB， 当前进程内存使用： 43264 kB871015 创建该格式的读模块： Esri 地理数据库（文件 Geodb）871007 尝试查询一个DYNAMIC插件给命名的读模块'GEODATABASE_FILE'23016 加载模块'GEODATABASE_FILE'从文件'C：\\Program Files\\FME\\plugins/..\\地理数据库9.dl

Is there any way to encrypt file in PGP in FME?

I'm working on a server app where users have to upload a photo taken with their phone. There's no need for them to browse the resource folders and so I've disabled access to the resources for that security token (except write access for the temporary folder where the images are stored). However, the users still have the option to browse the resource system: Ideally I'd want that "Browse resources" button to be gone and just have "Upload file". Is there any way to do that (other than write an app of my own)?