FME Server Connections Runtime Error: Unauthorized request by user due to lack of proper permissions

Symptom

I have a workspace that contains a web or database connection and when I attempt to run this workspace on FME Server my translation fails and in the job log I see the error message:

Unauthorized request by user due to lack of proper permissions

 

Cause(s)

This error indicates that the user or token being used to submit the workspace to run, has not been granted access permissions to the connection(s) being used within the workspace. There are a number of reasons why you may have encountered this issue.

Backup & Restore

You have performed a backup and restore of an older version of FME Server and the permissions were not properly assigned. Due to security improvements this is expected if you are moving to FME Server 2020 or newer from any prior version. Please review this article for more information.

Webhook or Server App Token

In FME Server 2020 if you create a Webhook or Server App where the Connection information is not stored as a Published Parameter you will not be prompted by FME to assign these permissions. Instead you will have to edit the token after it has been created. See the resolution in this article under ‘API Token Permissions’ header for further instructions.
In FME Server 2020.2 Connections stored in Private Parameters are now also detected and in FME Server 2021.1 all Connection dependencies are granted, so if you are using FME Server 2021.1 or newer you should not encounter this issue with Webhook or Server Apps. 

Connection Unavailable

If another user has shared this workspace with you, they will also need to share the specific connection used, or else you will not have correct permissions.

If you own the workspace but the connection is not available, you may have forgotten to include it with the workspace during the publishing process.

Unauthorized Access

If you do not have permission to access the connection, however you know the name the connection is being stored under, and try to access the connection e.g. by manually typing in the name of that connection.

Windows Authentication

On FME Server if you are using windows authentication to access your database, this will use the account running the FME Engine service. 
 

Resolution

You will need to ensure the User account or the API Token that is submitting the workspace has access permissions to the connection(s) being used in that workspace.

 

User Permissions (Run Workspace/Schedule/Automations)

First you can perform a quick check to confirm that the issue is because your user account does not have access to the connection by going to the appropriate Web or Database page under Files & Connections and see if it is listed. If it is listed, please contact Safe Software Support for further assistance. If it is not (or you do not have access to this page to check), you have a series of options available to get this set up.

 

Request Access Permissions from your Administrator

You can ask a user with admin privileges to provide access to the web connection using the following instructions.

1. Go to Admin > User Management > Users

2. Find your user account and click on it to edit permissions

3. Under the Permissions Window locate the Connections Item and select the drop down arrow ‘See More Permissions’

4. From the list find the connection being used in your workspace check the ‘Access’ box for that specific Connection

5. Select OK to save the changes

Ask an Admin to define your users permissions

 

Request Sharing from Workspace Owner

If the workspace was owned and shared with you by another user, you will need to ask them to share this connection.

1. Go to the appropriate Web or Database page under Files & Connections

2. Click on the ‘Share with Others’ button

3. Find your user name and give ‘Full Access’ permissions and select OK

Steps to ask another user to share their connection with you

 

Create a New Connection

If the workspace was provided by another user, they may prefer you create your own connection to be used in the workspace that is tied to your own access credentials.

1. You can do this through the FME Server Web UI

   • Database Connections

   • Web Connections

2. When configuring the workspace to run, set the Connection Published Parameter to this new connection.

Create a New Connection from the FME Server Web UI

 

Publish the Connection

If you own the workspace but the connection is not available you may have opted out of including the connection in the publishing process.

1. Return to FME Workbench and select ‘Publish to FME Server’

2. On the ‘Upload Connections’ page in the publishing Wizard ensure the checkbox is ticked for the connections used in this workspace

Upload connection when you publish the workspace to FME Server

Alternatively you can follow the steps in the previous section to recreate the connection on FME Server.

 

API Token Permissions (Server Apps/Webhook/Rest API)

If you create Server App, or set up the workspace to be run through a third party web application using a webhook or a Rest API request then you must create a token to provide access to the workspace and its components.

User is the Token Owner

1. Click on the User Settings Icon in the top right corner and select ‘Manage Tokens’.

2. Under API Tokens locate the token being used for your workspace and click on it to make edits

3. Under the Permissions Window locate the Connections Item and select the the drop down arrow ‘See More Permissions’

4. From the list find the connection being used in your workspace check the ‘Access’ box for that specific Connection

5. Select OK to save the changes

Assign Access permissions to an API Token

 

User is not the Token Owner

1. Click on the User Settings Icon in the top right corner and select ‘Manage Tokens’.

2. Go to the All Tokens page

3. Find the Token and click on it

4. There will be a banner at the top of the page telling you who owns this token. Contact them and ask them to follow steps 1-4 in the section above.

Find the Owner of an API Token

Windows Authentication

On the machine FME Server is installed on, you'll need to confirm that the Log on account for the FME Server Engine Service is a windows account that has permission to your database. You'll likely need your FME Server Administrator to make these changes. Please see our Documentation for more information.