3 Replies Latest reply on Feb 20, 2013 1:49 PM by demani

    Filemaker Server appears to cache permissions

    demani

      Summary

      Filemaker Server appears to cache permissions

      Product

      FileMaker Server

      Version

      11.0.4

      Operating system version

      10.6.8

      Description of the issue

      Filemaker Server does not reflect changes made to Open Directory membership when a user connects to the database a second time. If a user is in Group A, logs in, logs out and then is moved to Group B, the user continues to have Group A privileges until the server OS is restarted. If I restart the server (the machine, not just FMS) then I am able to use the new permissions, but once I login changes to that users OD membership are not reflected.
      Obviously this is a pretty bad situation since restarting the server when testing permissions and moving users between groups is an extremely inelegant solution. I don't think it is caching credentials per se (I can disable a user in OD and not be able to get in, and changing a password in OD does force the user to enter the new one), so I think it is passing the login info correctly, but I think it may be caching the permissions for the user-so changing the groups in OD doesn't show up in the Filemaker Server until the server machine is restarted.

      Steps to reproduce the problem

      Set up permissions in Filemaker linked to Open Directory groups.
      Assign User to Group A.
      Log in as User.
      Log out.
      Change OD group membership, putting User in Group B.
      Log in as User.

      Expected result

      User should have privileges assigned to Group B after second login.

      Actual result

      User retains privileges assigned to Group A until server OS is restarted.

      Configuration information

      Groups in Filemaker match OD group names exactly (and this works for initial reading of group membership).

      Workaround

      Restarting the server OS will enable any changes to be used, but the problem persists.

        • 1. Re: Filemaker Server appears to cache permissions
          user15307

          MV2011,

          Thank you for your post; apologies for the late reply.

          I'm unable to replicate the issue with this information alone.  If you can provide more detail, it would help. I have FileMaker Server 11.0.4 on OS X Server 10.6.8. 

          Here's what I have done:

          1. Two Open Directory groups: Group1 and Group2

          2. I have created two Externally Authenticating Accounts in FileMaker Pro for my test database: Group1 and Group2

          3. The Accounts in FileMaker for the file are assigned privilege sets: Group1 = FullAccess, Group2=ReadOnly

          4. Uploaded the test file to be hosted by Server

          4. Test User member of Group1 in Open Directory group manager, opens hosted file from client and has FullAccess.

          5. Delete Test User from Group1, put in Group2 in Open Directory, open hosted file from client and Test User has Read Only access.

          I didn't restart the server, but was able to have the Test User's privilege set change by changing Open Directory groups.  Please let me know what you have done differently so I can adjust my testing accordingly.  Thank you.

           

          TSTuatara

          FileMaker, Inc.

          • 2. Re: Filemaker Server appears to cache permissions
            AnswerFeedback_3

            I am having the exact symptoms as MV2011. I followed TSTuatara's workflow exactly to reproduce the problem generically outside my system.

            FileMaker Server 11.0.4 is installed on 2x2.8 GHz Quad Core Intel Xeon xserve running Mac OS X Server 10.6.8.

            • 3. Re: Filemaker Server appears to cache permissions
              demani

                   Just following up: the FMS server was on a separate machine from the OD server. Having them on the same machine is probably the deciding factor there.

                   I need to spend more time checking it out, but FMS 12 may be the same situation.