Password Protection for FME Workspaces

Q) Is it possible to encrypt or password protect a workspace in FME - how do I do it?
A) Yes it is possible to password protect a workspace. In the Workspace settings part of the navigation pane there is an 'advanced' section. Within here is a password option. If you set a password (and then save the workspace) it becomes both password protected and unreadable within a text editor.

Q) Can you show me in more detail?
Double-click the password setting in the Navigation pane to bring up the password dialog. Enter the password and enter again for confirmation to apply...

When opening the workspace for editing you will now be prompted to enter the password...

Not only is a password applied, but the file scrambled against casual observation. This is what a protected FMW file looks like in a text editor...

Q) Why would I add a password to an FME workspace file?
A) There are two reasons for protecting a workspace.

• To provide a user with an executable translation that is protected from editing.
• To enable a user/reseller/consultant to provide a custom solution without revealing the content.

So to these ends protecting a workspace gives the following...

• The body of the workspace file itself is encoded so that is cannot be read in a simple text editor.
• The workspace cannot be viewed or opened for editing within Workbench without the password.
• The workspace can be run from within the FME Quick Translator or from the command line without the password, or within Workbench with the password.

Q) Can I password protect FME files other than workspaces?

A) Yes, you can also protect:

• An exported custom transformer (.fmx) file
• A custom format (.fds) file.

Simply open them in Workbench and apply a password the same way as for a workspace.


Q) Can I password protect a mapping file?

A) Yes - the same technique applies, but you do it from the command line.


Q) Can't I use the FME_DEBUG command to view the contents of a file? Is this a workaround?

A) No - not when the file is password protected...


This is the debug command used on the command line...

And this is what the log reports...

Q) How secure is a password protected workspace?

A) We've taken efforts to make them as secure as possible to casual scrutiny. For example, there's no use anyone trying the FME_DEBUG keyword with the MAPPING_FILE option because we've made it invalid on protected content. I tried a number of ways to view a protected workspace in a text editor, or otherwise access the content, and couldn't.


However - we won't guarantee absolute security. We encode files, but we don't encrypt them; so it isn't like your local security agency of choice couldn't read them in ten seconds if you're thinking of creating a custom transformer such as 'DirtyMoneyLaunderer'!


As with all IT systems you can help security by...

• Choosing a non-obvious password (ie not your name, your initials, your company name, "FME", "password", "pa$$word" etc)
• Choosing a longer password (in general longer passwords are more secure)