User manual

Chapter 6
|
Protecting databases 131
5. To force the account users to choose a new password the first time they log in, choose User must change
password on next login.
In most cases, an account that is shared by multiple users should not force a password change upon first
login. Instead, you should specify a password and provide it to the users that need it. Also, the privilege
set for a shared account should not permit password changes because one user could change the password
and lock out all other users who share the account.
6. For Account Status, choose whether you want the account to be active or inactive.
For example, you may want to keep the account inactive until you finish setting up its privilege set. Users
cannot open a database using an inactive account name and password.
7. For Privilege Set, choose the privilege set you want to use with this account.
You can choose an existing privilege set, or choose New Privilege Set and create a new one. For more
information, see
“Creating privilege sets” on page 132.
8. For Description, enter a description of the account (optional).
9. Click OK.
10. In the Manage Security dialog box, click OK.
11. In the dialog box that appears, enter an account name and password that is assigned the Full Access
privilege set, and click OK.
Creating accounts that authenticate via an external server
If you’re hosting FileMaker Pro database files with FileMaker Server and your organization uses centrally
managed authentication for users and groups such as Apple OpenDirectory or a Windows Domain, you can
set up accounts that authenticate users based on your authentication server. This allows you to use your
existing authentication server to control access to databases without having to manage an independent list
of accounts in each FileMaker
Pro database file.
Note Only database files hosted by FileMaker Server can authenticate users against an authentication
server. Database files shared by FileMaker
Pro won’t authenticate against an authentication server.
Important When a database file contains one or more External Server accounts, make sure you use operating
system security settings to limit direct access to the file. Otherwise, it might be possible for an unauthorized
user to move the file to another system that replicates your authentication server environment and gain
access to the file. For more information, see the FileMaker
Server documentation.
To create an account that authenticates via an external server:
1. Choose File menu > Manage > Security.
2. In the Accounts tab, click New.
3. In the Edit Account dialog box, for Account is authenticated via, choose External Server.
4. For Group Name, enter the name of a group that is defined on an external authentication server.
5. For Account Status, choose whether you want the account to be active or inactive.