FME Flow Connections Runtime Error: Unauthorized request by user due to lack of proper permissions

Symptom

I have a workspace that contains a web or database connection, and when I attempt to run this workspace on FME Flow (formerly FME Server), my translation fails, and in the job log, I see the error message:

Unauthorized request by user due to lack of proper permissions

Cause(s)

This error indicates that the user or token used to submit the workspace for execution has not been granted access permissions to the connection(s) used within the workspace. There are several reasons you may have encountered this issue.

Backup & Restore

You have performed a backup and restore of an older version of FME Flow and the permissions were not properly assigned. Due to security improvements, this may be expected when moving to a newer version of FME Flow from an earlier one.

Connection Unavailable

If another user has shared this workspace with you, they will also need to share the specific connection used; otherwise, you will not have the correct permissions.

If you own the workspace but the connection is not available, you may have forgotten to include it with the workspace during the publishing process.

Unauthorized Access

If you do not have permission to access the connection, but you know the name the connection is being stored under, and try to access the connection, e.g., by manually typing in the name of that connection.

Windows Authentication

On FME Flow, if you are using Windows authentication to access your database, this will use the account running the FME Engine service. 

Resolution

You will need to ensure that the User account or the API Token submitting the workspace has access permissions to the connection(s) used in that workspace.

User Permissions (Run Workspace/Schedule/Automations)

First, you can perform a quick check to confirm that the issue is due to your user account not having access to the connection by going to the appropriate Web or Database Connections page under Connections & Parameters and checking whether it is listed. If it is listed, please contact Safe Software Support for further assistance. If it is not (or you do not have access to this page to check), you have a series of options available to get this set up.

Request Access Permissions from your Administrator

You can ask a user with admin privileges to provide access to the web connection using the following instructions.

1. Go to Admin > User Management > Users
2. Find your user account and click on it to edit permissions
3. Under Permissions, locate the Connections Item and click the drop-down arrow ‘Show Connections’
4. From the list, find the connection being used in your workspace. Click the drop-down under Summary and select Full Access
5. Click Save to save the changes

Ask an Admin to define your user's permissions

Request Sharing from Workspace Owner

If the workspace was owned by another user and shared with you, you will need to ask them to share this connection.

1. Go to the appropriate Web or Database Connections page under Connections & Parameters
2. Click on the ‘Share with Others’ button
3. Find your username and give ‘Full Access’ permissions and select Share

Steps to ask another user to share their connection with you

Create a New Connection

If the workspace was provided by another user, they may prefer that you create your own connection for use in the workspace, tied to your own access credentials.

1. You can do this through the FME Flow Web UI. See the documentation links below for specific instructions.

• Database Connections
• Web Connections

2. When configuring the workspace to run, set the Connection User Parameter to this new connection.

Create a New Connection from the FME Flow Web UI

Publish the Connection

If you own the workspace but the connection is unavailable, you may have opted out of including it in the publishing process.

1. Return to FME Workbench and click ‘Publish to FME Flow’

2. On the ‘Upload Connections’ page in the publishing wizard, ensure the checkbox is enabled for the connections used in this workspace

Upload connections when you publish the workspace to FME Flow

Alternatively, you can follow the steps in the previous section to recreate the connection on FME Flow.

API Token Permissions (Flow Apps/Webhook/REST API)

If you create a Flow App or set up the workspace to run through a third-party web application via a webhook or REST API request, you must create a token to access the workspace and its components.

User is the Token Owner

1. Click on the User Settings Icon in the top right corner of FME Flow and select ‘Manage Tokens’.

2. Under API Tokens, locate the token being used for your workspace and click on it to make edits

3. Under Permissions, locate the Connections Item and click the drop-down arrow ‘Show Connections’

4. From the list, find the connection being used in your workspace. Click the drop-down under Summary and select ‘Full Access’

5. Click Save to save the changes

Assign Access permissions to an API Token

User is not the Token Owner

If the user is not the token owner, contact your FME Flow administrator. They will be able to provide the user with the appropriate permissions to access the desired token.

Windows Authentication

On the machine where FME Flow is installed, you'll need to confirm that the Log on account for the FME Flow Engine Service is a Windows account with permission to your database. You'll likely need your FME Flow Administrator to make these changes. Please see our Documentation for more information.