Security

Hi, I am trying to connecto to an API that supports only POST method to generate the tokens via OAuth2. After some testing and fiddling, I can see that FME Desktop (2022.2) sends first a GET request when trying to get the token. So this request is declined by the server and I cannot continue further. Is there a way to enforce POST for the whole OAuth2 flow in Desktop/Server?

When importing the certificate i get this error? Has anyone had this happen and what was their resolution?

I'm wondering to what degree items uploaded to FME Hub are checked? Are they considered "safe to download" or "use at your own risk"? Imagine a wild scenario where I would upload a custom transformer with a SystemCaller in it that formats the c drive, will that get flagged or not? (and what if I password-protect it?)

Hi, Where can I download License Generator that I need to use for my LicenseChecker?

Hello, I am trying to collect and maintain some metadata for FME Workbench, which includes the database connections attributes that each of our workbenches (.fmw files) use. We are currently using FME Desktop 2021.2 on Windows. So far, I have extracted the Database Connection information from the fme_connections.data file using a SQLite transformer. However, many of the values including User_Name are encrypted (fme_enc2). I realize I am stepping into the realm of security and cryptography - and also realize that if I gain access to the user names, I will be able to apply the same principles to passwords and other sensitive data in the Database Connections - and absolutely respect the principle of protecting secrets. That said, I am an FME administrator for my organization, and have access to both the fme_publicKey and fme_privateKey files - and am really only interested in the User Names associated with the connections. If there is a better way to collect that information than b

I know there is a lot of content covering this topic already, so I'll preface this by saying I have looked through it. I looked at the floating license server troubleshooting article here and the article about serving both ArcGIS and Safe licenses here and I have run the diagnostic .bat file. My issue is this: I can connect to the floating license server without issue, but one colleague can't connect at all, and another one can connect intermittently but always seems to encounter a similar issue to the one who can't connect at all. SETUPec2 instance in AWS behind a network load balancer, with both ArcGIS License Manager 2021.1 and Flexera 11.16.2 installed. The license files for both are stored in the "License" folder for ArcGIS, and each license file specifies a unique port to use (ArcGIS Vendor: 27009, Safe Vendor: 27002). Instance firewall has ports 27000-27009 open and security group settings allowing traffic on those ports from our specific office IP's. T

The following files were detected as maleware:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlexNet for Safe Software\restartService.batC:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlexNet for Safe Software\Start - Restart FME License Server.lnkC:\Program Files\FlexServer\BatchFiles\restartService.bat  

Hi, I have tried to follow the suggestions in this thread to connect to Mapillary API without success.https://community.safe.com/s/question/0D54Q00008vZLePSAW/hi-have-anybody-succeeded-in-connecting-the-mapillary-api-v4-with-fme-workbench-i-get-stuck-on-an-internal-server-error-when-i-use-httpslocalhost-as-redirect-url-in-the-oauth-20-webservice-authentification I am using these settings:I am just getting a login page when I test the service: Any suggestions? The result is the same with http://localhost and https://localhost. It is the same when adding Authorization under HTTP Header for Retrieve Token Parameters. Anyone got any suggestions on how to connect to the API and for example get coverage tiles.

Hi,My organisation provided me a CA signed PFX certificate.I have followed the step-by-step guide to update server.xml, web.xml and content.xml, etc.I am able to restart the FME server service.However, when I use https://locahost/ or https://<server name>/fmeserver/I contantly get the message "This is site can't provide a secure connection", and ERR_SSL_PROTOCOL_ERROR.click the (i) at the URL address bar shows NO certificate.I checked the other internal site, it states "This site does not have certificate."I couldn't complete the export and import Base-64 encoded X.509 cer file.How can I move forward from here to complete the HTTPS enabling?ThanksHelen

Hi there, I am trying to use FME to automate some user management for FME Server. Specifically I would like to schedule a workspace to remove any Azure users that are not members of a role. I have worked out how to list the users and get their roles, but I can't work out how to go from this json array: ["user:admin","fmeadmin","fmesuperuser"] to the integer value 2. Can anyone please help me drop the "user:..." part from the array and count the number of items that are left over? Thanks!Marc

Hi, I am trying to expose an attribute from the _response_body returned from a http caller. This is the response: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2022-11-24T11:20:34.572Z</u:Created><u:Expires>2022-11-24T11:25:34.572Z</u:Expires></u:Timestamp></o:Security></s:Header><s:Body><CreateWorksheetResponse xmlns="http://webservices.whitespacews.com/"><CreateWorksheetResult xmlns:a="http://webservices.whitespacews.com/API/" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><CodeDescription>Success</CodeDescription><ErrorCode>

Hello everyone,In regards to the security issues in regards to Apache Text Commons 1.6 till 1.9, I was wondering whether FME dekstop makes use of this file and if yes, one needs to be worried about it?

I have set up integration between FME Server (v2021.2.6) and Azure AD where I am able to import users from AAD and native AAD users are able to single sign in using microsoft. The problem is that Guest users in AAD are not able to single sign in using Microsoft login. It seems that the FME server logon instead tries to authenticate through the users home-tenant. Does anyone have experience with this setup?

Windows 2019/ FME Server 2022.0.2. We weary of doing full FME Server upgrades when all we really need to do is upgrade Tomcat for security vulnerabilities. TC is currently embedded in Server, can we install latest TC externally (on the server but not part of fme) and hook to that?

Hi! Have anybody succeeded in connecting the Mapillary API v4 with FME workbench? I get stuck on an internal server error when i use https://localhost/ as redirect URL in the OAuth 2.0 webservice authentification.

We are on the process to upgrade FME 2015 to 2020. Because all of the security regulations our cybersecuirty team blocking this from happening without getting an answers for the following question, we do appreciate if you can help us with this.What types of applications are being coded and in what languages?What training has been provided or completed in secure application development by the development team?What is the Software Development LifeCycle, and how does security form a part of this?Do the applications take inputs or variables? If yes, how are they sanitised?Are whitelists being used in place of blacklisted characters?Are automated tools used to scan for vulnerabilities, what is the time frame for high and critical vulnerabilities to be remediated?Where will the code repository sit?How are error exceptions handled?What network separation is there from Dev/ QA/ Prod, who reviews the code? 

Hello,Is there any info if FME server is affected by new vulnerability CVE-2022-42889 (Apache Commons Text versions 1.5 through 1.9)?

When creating a connect to AD, what is the synchronnization period?

I've been digging into issues with an Engine running on a separate host in a distributed setup. Service looks to be running but is no longer chatting with Core and is not longer showing up under Engines in the web UI. After ruling out some of the obvious causes on this troubleshooting page. I've started logging running processes and ports being used on that Host to understand at what point the service goes silent or inactive. That's when I noticed what seems like large number of TCP connections FMEProcessMonitorEngines uses with multiple ports open. The Architecture Diagram and Documentation are really helpful. So I recognize the 7070 for FMEEngines services and the 7082 for Database Server but then there are a bunch of ports that I assume are what FME dynamically picks. If I only have one job executing on that engine at a given time, how many of those ports/connections will be in play? Is having 3-5 or so that I don't recognize an indication that something may not be

https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities In this latest advisory it's mentioned that there are two specific XSS issues, and two different CVE assignments. That's all well and good, even if there is a ton of lacking pertinent information.  The problem I'm having is that this CVE (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38339) was assigned to this specific advisory but there's zero mention of it. Does anyone know specifically why 2022-38339 was assigned?

Quick question about the Windows account that FME Server uses. If I write an FME script that reads from, say, a CSV file and writes to an Oracle table, the Oracle account that gets used is specified in the connection parameters. But what Windows account

Using FME(R) 2021.2.5.0 (20220331 - Build 21816 - WIN64)  desktop on windows PRO build 2009.1766 65g RAM, 6 cores, experiences massive CPU drain when running a LIDAR density analysis out to raster via the custom transformer as in article - Calculating Point Cloud Density (safe.com)The two step tiler seems to trigger a Windows security scan when using the FME_TEMP directory as FME writes the (many) temporary cache ffs files down to disk when demanding a 1m high res raster result. The security kicks in and the CPU starts skipping up to 80%+ which drags the performance way down on large LIDAR file sets. Setting the raster res lower (10m) doesn't seem to trigger the same issue The FME_TEMP directory cannot be included in the security white list (corporate policy settings only - as each workstation /individual may have a different FME_TEMP location), and therefore although FME and the install directories are white-listed per FME Community (safe.com), the FME_TEMP directory is subject to

I have created an encoded password user parameter and used it with the job submitter, but if the job submitter returns an error, the password is decrypted and shown in the log, as seen in the screenshots below.  

Hi,I have a FME workbench, so i have to use it within my organization and i want to restrict it to outsiders based on domain name or in any possible way. how can i do this ?

Dear community,Upcoming June the 14th Microsoft DCOM will get ‘hardened’ by a update. Therefore I would like to know if the DCOM-protocol is used in any way within FME and if anyone knows this update could affect FME server. If this is the case, it is necessary to test the new hardening. For more information on this update: (https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c) Used FME server versions: FME server 2018.1 & 2021.1