User manual

Chapter 6 | Protecting databases 137
Creating accounts that authenticate via an external server
If you’re hosting FileMaker Pro database files with FileMaker Server and your organization uses
centrally managed authentication for users and groups such as Apple OpenDirectory or a
Windows Domain, you can set up accounts that authenticate users based on your authentication
server. This allows you to use your existing authentication server to control access to databases
without having to manage an independent list of accounts in each FileMaker
Pro database file.
Note Only database files hosted by FileMaker Server can authenticate users against an
authentication server. Database files shared by FileMaker
Pro won’t authenticate against an
authentication server.
Important When a database file contains one or more External Server accounts, make sure you
use operating system security settings to limit direct access to the file. Otherwise, it might be
possible for an unauthorized user to move the file to another system that replicates your
authentication server environment and gain access to the file. For more information, see the
FileMaker
Server documentation.
To create an account that authenticates via an external server:
1. Choose File menu > Manage > Security.
2. In the Accounts tab, click New.
3. In the Edit Account dialog box, for Account is authenticated via, choose External Server.
4. For Group Name, enter the name of a group that is defined on an external authentication server.
5. For Account Status, choose whether you want the account to be active or inactive.
6. For Privilege Set, choose the privilege set you want to use with this account.
The privilege set assigned to the account determines what the externally authenticated group
members can do in the database file. You can choose an existing privilege set, or choose New
Privilege Set and create a new one. For more information, see the next section.
7. For Description, enter a description of the account (optional).
8. Click OK.
9. In the Manage Security dialog box, click OK.
10. In the dialog box that appears, enter an account name and password that is assigned the Full
Access privilege set, and click OK.
Creating privilege sets
You can assign each privilege set to one or more accounts.
To create a privilege set:
1. Follow the steps above to display the privilege sets for a file.