Help

Configuring Database Server settings Database Server security settings
F
ILEMAKER SERVER 9 HELP 72
External authentication for database access
FileMaker Server authenticates users with FileMaker accounts defined within a FileMaker Pro
database. In addition, FileMaker Server supports authentication
with the following externally defined
accounts and groups:
• Windows or Mac OS accounts and groups locally defined on the master
machine
• Apple Open Directory and Windows Active Directory
accounts and groups, which can be on
a centrally-managed authentication server
If you’re hosting FileMaker Pro database files with FileMaker Server, you can use your existing
authentication server to control access to databases without having to manage an independent list
of accounts in each FileMaker Pro database file.
If in the Database Server > Security tab you choose FileMaker and external server accounts,
the clients’ access privileges
are determined by the accounts defined in the hosted databases and
by accounts that are defined on the master machine or on an authentication server. Using
FileMaker Pro, you specify in a database whether an account is authenticated via FileMaker or an
external authentication server. These are Active Directory accounts (Windows) or Open Directory
accounts (Mac OS). Depending on the specific network configuration, an external authentication
server on one platform can authenticate users on the other platform. In other words, a Mac OS user
might be authenticated by Active Directory or a Windows user might be authenticated by Open
Directory in Mac OS X Server.
If you choose FileMaker and external server accounts, records of all login attempts are logged in
the Windows Security Log, if the master machine is a Windows machine. For more information
about the Security Log, see your Windows documentation.
Important When a database file contains one or more External Server accounts, make sure you
use operating system security settings to limit direct access to the file. Otherwise, it might be
possible for an unauthorized user to move the file to another system that replicates your
authentication server environment and gain access to the file. Group names for accounts
authenticated with the external server feature are stored as text strings. If the group name is
reproduced on another system, the copied file can be accessed with the privilege set
assigned to
the members of the group, which might expose data inappropriately.
Notes
• For more information on setting up accounts in FileMaker Pro, see “Creating accounts that
authenticate via an external server” in FileMaker Pro Help.
• For more information on setting up external authentication, go to www.filemaker.com/kb
and
search for articles containing the keywords external and authentication (and optionally
cross-platform).
Related topics
Database Server security settings (page 70)
Securing your data
(page 125)