Administrator’s Guide

28 FileMaker Server Administrator’s Guide
Windows: Configure FileMaker Server security with the Security
assistant or select host and then choose
Action menu > Properties >
Security
tab.
Mac OS: To configure FileMaker Server security, choose View
menu > Configure, then click the Security tab.
Defining groups for use with security features (Windows)
If you are serving files that use External Server accounts, in order to
use administrator authentication, client authentication, or to filter the
display of database files for local or domain users, you must:
1 Define a group on the local system or domain controller. See
Windows Help for more information on defining groups.
Important For administrator authentication, this account must be
named
fmsadmin.
1 Assign to this group the user accounts that will use external server
authentication.
1 Add the group to the Log on as a service security policy property.
1 For local accounts: Click the Start button > Settings > Control
Panel > Administrative Tools > Local Security Policy > Security Settings
> Local Policies > User Right Assignment > Log on as a service.
1 For domain accounts: Click the Start button > Settings > Control
Panel > Administrative Tools > Domain Controller Security Policy >
Security Settings > Local Policies > User Right Assignment > Log on as
a service.
Note Single Sign-on (SSO) for Windows networks does not require
the above policy settings.
Authenticating client log in
Client access to hosted databases is determined by accounts defined
in FileMaker
Pro. You can choose how FileMaker Server clients are
authenticated when they connect to databases hosted by FileMaker
Server.
If you choose FileMaker accounts only, the clients’ access privileges
are determined by the accounts defined in the hosted databases.
If you choose FileMaker and External Server Accounts, the clients’
access privileges are determined by the accounts defined in the
hosted databases and by accounts that are set up on the same
computer as FileMaker Server (locally) or on an authentication
server such as Mac
OS X Server or a Windows Domain server. This