FME Flow Connections Runtime Error: Unauthorized request by user due to lack of proper permissions

Symptom

I have a workspace that contains a web or database connection and when I attempt to run this workspace on FME Flow (formerly FME Server), my translation fails and in the job log, I see the error message:

Unauthorized request by user due to lack of proper permissions

Cause(s)

This error indicates that the user or token being used to submit the workspace to run, has not been granted access permissions to the connection(s) being used within the workspace. There are a number of reasons why you may have encountered this issue.

Backup & Restore

You have performed a backup and restore of an older version of FME Flow and the permissions were not properly assigned. Due to security improvements this may be expected if you are moving to a newer version of FME Flow from an earlier version.

Connection Unavailable

If another user has shared this workspace with you, they will also need to share the specific connection used, or else you will not have correct permissions.

If you own the workspace but the connection is not available, you may have forgotten to include it with the workspace during the publishing process.

Unauthorized Access

If you do not have permission to access the connection, but you know the name the connection is being stored under, and try to access the connection e.g. by manually typing in the name of that connection.

Windows Authentication

On FME Flow, if you are using Windows authentication to access your database, this will use the account running the FME Engine service. 

Resolution

You will need to ensure the User account or the API Token that is submitting the workspace has access permissions to the connection(s) being used in that workspace.

User Permissions (Run Workspace/Schedule/Automations)

First, you can perform a quick check to confirm that the issue is because your user account does not have access to the connection by going to the appropriate Web or Database Connections page under Connections & Parameters and see if it is listed. If it is listed, please contact Safe Software Support for further assistance. If it is not (or you do not have access to this page to check), you have a series of options available to get this set up.

Request Access Permissions from your Administrator

You can ask a user with admin privileges to provide access to the web connection using the following instructions.

1. Go to Admin > User Management > Users
   
   
2. Find your user account and click on it to edit permissions
   
   
3. Under Permissions, locate the Connections Item and click the drop-down arrow ‘Show Connections’
   
   
4. From the list, find the connection being used in your workspace. Click the drop-down under Summary and select Full Access
   
   
5. Click Save to save the changes
   
   

Ask an Admin to define your users permissions

Request Sharing from Workspace Owner

If the workspace was owned and shared with you by another user, you will need to ask them to share this connection.

1. Go to the appropriate Web or Database Connections page under Connections & Parameters
2. Click on the ‘Share with Others’ button
3. Find your user name and give ‘Full Access’ permissions and select Share

Steps to ask another user to share their connection with you

Create a New Connection

If the workspace was provided by another user, they may prefer you create your own connection to be used in the workspace that is tied to your own access credentials.

1. You can do this through the FME Flow Web UI. See the documentation links below for specific instructions.
   
   • Database Connections
   • Web Connections
     
     
2. When configuring the workspace to run, set the Connection Published Parameter to this new connection.
   
   

Create a New Connection from the FME Flow Web UI

Publish the Connection

If you own the workspace but the connection is not available, you may have opted out of including the connection in the publishing process.

1. Return to FME Workbench and click ‘Publish to FME Flow’
2. On the ‘Upload Connections’ page in the publishing Wizard ensure the checkbox is enabled for the connections used in this workspace

Upload connection when you publish the workspace to FME Flow

Alternatively, you can follow the steps in the previous section to recreate the connection on FME Flow.

API Token Permissions (Flow Apps/Webhook/REST API)

If you create a Flow App or set up the workspace to be run through a third-party web application using a webhook or a REST API request, then you must create a token to provide access to the workspace and its components.

User is the Token Owner

1. Click on the User Settings Icon in the top right corner of FME Flow and select ‘Manage Tokens’.
2. Under API Tokens locate the token being used for your workspace and click on it to make edits
3. Under Permissions, locate the Connections Item and click the drop-down arrow ‘Show Connections’
4. From the list, find the connection being used in your workspace. Click the drop-down under Summary and select ‘Full Access’
5. Click Save to save the changes

Assign Access permissions to an API Token

User is not the Token Owner

If the user is not the token owner, contact your FME Flow administrator. They will be able to provide the user with the proper permissions for accessing the desired token.

Windows Authentication

On the machine FME Flow is installed on, you'll need to confirm that the Log on account for the FME Flow Engine Service is a windows account that has permission to your database. You'll likely need your FME Flow Administrator to make these changes. Please see our Documentation for more information.