Search

FME Flow Troubleshooting: Integrated Windows Authentication or Single Sign On

Liz Sanderson
Liz Sanderson
  • Updated

Full Guide: FME Flow Troubleshooting Guide

Are you encountering issues configuring FME Flow (formerly FME Server) for IWA/SSO? Please read below for some common troubleshooting tips and issues.

In 2023, FME Server was renamed to FME Flow. Since this article discusses features present in previous versions of FME, it will refer to both names interchangeably, using the appropriate product name based on the year the feature was introduced. For more information on the rebranding, see our website. 

Content Overview

Initial Troubleshooting

  • Is it just SSO that fails, or does logging in with your Active Directory credentials work? If you are also experiencing problems with AD, please review this troubleshooting guide.
  • Have you followed all the configuration steps? (This doc is for the current release; please use the correct version for your installation, which can be found in the help section after logging into FME Flow)
  • Are you using a supported browser? Single Sign-On is currently supported in Microsoft Edge, Firefox, and Chrome.
  • It is known that SSO will not work if you are logged into the machine where FME Flow is installed – please test connecting from a different machine.
  • Have you checked the log files located in <FMEFlowFileShare>/Resources/Logs/Core? In particular, look in the fmedirectoryserver.log and the fmeserver.log for messages starting with '(Active Directory)' or '(Single Sign-On)'. See the Authentication Failures section below for resolutions to common errors.

Authentication Failures

Check out the resolution on the relevant documentation page if you see any of the following errors in the fmeserver.log or the fmedirectoryserver.log:

Failure to Connect to Directory Server (SSL):

The following message appears in the Directory Servers page:

An error occurred while communicating with directory server (81) or (91)

and the log file reports:

(Directory Server) Exception: "An error occurred while attempting to send the LDAP message to "...": javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target caused by sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target caused by sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"

Unable to Use SASL Authentication:

(Directory Server) Not using SASL for authentication, because configuration is incomplete.​​​​

Unsupported SASL Mechanism:

(Directory Server) SASL mechanism "..." is not supported by Directory Server.

Incorrect Mechanism:

(Single Sign-On) Client attempted NTLM authentication; single sign-on authentication supports only Kerberos V5 authentication. Refer to single sign-on documentation for resolution.
(Single Sign-On) Failed authentication because of an invalid client token. Refer to single sign-on documentation for resolution.

Negotiation Error:

(Single Sign-On) Negotiation reported an error: "Failure unspecified at GSS-API level (Mechanism level: Checksum failed)".
(Single Sign-On) Failed authentication because of an negotiation error. Refer to single sign-on documentation for resolution.

OR

(Single Sign-On) Negotiation reported a defective token from client: "...".
(Single Sign-On) Failed authentication because of an negotiation error. Refer to single sign-on documentation for resolution.

OR

(Single Sign-On) Negotiation reported an error: "...".
(Single Sign-On) Failed authentication because of an negotiation error. Refer to single sign-on documentation for resolution.
  • Make sure the SPNs are entered as https://server.com instead of http://server.com. HTTP and HTTPS Protocols both use the HTTP Service Class.

Service Account:

(Single Sign-On) Failed authentication using pre-authenticated credentials (for a service account).
(Single Sign-On) Failed to create server credentials. Ensure that pre-authenticated credentials (for a service account) are correctly specified in single sign-on configuration.

Cross-Domain User:

(Single Sign-On) Negotiation complete; authentication granted for user "...".
(Single Sign-On) Failed authentication because user "..." could not be found in Active Directory.

Same Machine Access:

(Single Sign-On) Negotiation reported a defective token from client: "Defective token detected (Mechanism level: GSSHeader did not find the right tag)".
(Single Sign-On) Failed authentication because of an negotiation error. Refer to single sign-on documentation for resolution.

Further Troubleshooting

  • Did SSO work in a previous installation of FME Flow? Is the current configuration provided from a Backup/Restore process?
  • Are you using multiple domains, or have you set your “realm” parameter?
  • Is the Host domain controller a round-robin or load-balancing domain controller, or are you pointing directly at a single domain controller machine? Currently, you must point directly to the domain controller; if additional domain controllers are required, please add them to the Alternate Servers.
  • Is your KDC separate from the Domain Controller machine, if so please ensure you have specified the KDC Host parameter.
  • Is your SPN set up correctly? The green comment on this post highlights the need to have both the SPN set for the machine name and any CNAME specified for the server.
  • Have you configured your FME Flow for HTTPS? Was SSO working correctly prior to this being set up?
  • Is your Active Directory Domain Controller set up to use HTTPS? Have you imported the CA Certificate into FME Flow's trusted list?

Common Issues

"When I click on the 'Use Windows Credentials' button, an additional sign-in dialog pops up"

Using Google Chrome, after attempting to log in to FME using SSO, a second Sign In box appears requesting my credentials:

signin.png

But if I enter my credentials and click Sign in, nothing loads and the page stays blank. When I check the fmeserver.log there is no record of my attempt to sign in, this is because the client browser does not trust my server, so logging will be limited.

This is a web browser configuration issue that can be resolved in Internet Options by adding FME Flow to the list of trusted sites. You can find instructions for this under the Microsoft Edge heading here.

“Using ‘Use Windows Credentials, ’ I am returned with 'You are not authorized to access this web application”

When I attempt to log in to FME Flow via single sign-on, the login page displays a warning that I am not authorized to access this web application. However, if I enter my Active Directory credentials, the login succeeds.

fmeserverunauthorised.png

There are two known causes for this error.

1. For your Active Directory connection setup, check what you have entered for the SSO Service Account Name. This username should just be entered as USERNAME (i.e., no DOMAIN), unlike the Search Account Name. If you have entered a domain name here, you will see the above error and be unable to log in using SSO.

2. Please specify a Realm in the Optional Fields section of the Active Directory Connection setup.

“In the fmeserver.log there is an Encryption type error reported”

When attempting to configure single sign-on, you may not be able to log in automatically, even though everything is configured correctly in the FME Flow configuration files. If you find the following error in the fmeserver.log

Failure unspecified at GSS-API level (Mechanism level: Encryption type AES256 CTS mode with HMAC SHA1-96 is not supported/enabled)

“When I attempt to use SSO, the fmeserver.log records a failed login by user due to No SASL mechanism specified in configuration”

In FME Server 2021.0, there is a known GUI issue with the incorrect Authentication Type being set by the Web UI when single sign-on is enabled. To work around this issue, you'll need to remove the connection and create it using the REST API POST /security/ldap/servers. For more information, please see this article. 

"When I attempt to use SSO, I receive a Login failed message, and there is nothing in the FME Flow logs. My FME Flow is configured for HTTPS."

Ensure that you have correctly updated the propertiesFile.properties, located in <FMEFlowDir>\Utilities\tomcat\webapps\fmeserver\WEB-INF\conf\
Within the propertiesFile, locate the SINGLE_SIGN_ON_AUTH_URL parameter and ensure it is using HTTPS. Update the hostname and port in the URL to match the hostname used to access the FME Flow Web User Interface.

Are you still experiencing issues?

Please consider posting to the FME Community Q&A if you are still experiencing issues that are not addressed in this article. There are also different support channels available.

If you have checked all the troubleshooting steps listed above, then this will help refine where the disconnect is. If all these check out, you can change the DEBUG_LEVEL to FINEST in the tomcat propertiesFile.properties. This configuration file is located at <FMEFlowDir>/Utilities/tomcat/webapps/fmeserver/WEB-INF/conf/propertiesFile.properties on a default installation. You will need to restart FME Flow to apply these changes. Once you have tried logging in again, share a copy of the logs folder with Support, along with the answers to the questions above.

Have ideas on how to improve this?

You can add ideas or product suggestions to our Ideas Exchange.

Here are some existing ideas:

Was this article helpful?

We're sorry to hear that.

Please tell us why.

As of January 14th, 2026, comments on knowledge base articles have been closed. To make sure questions don’t get missed and to enable more community support, we’ve moved discussions to the FME Community. If you have a question or a comment about this article, please create a new post or create a support ticket.