Known Issue: FME Flow SSO failed login due to insufficient credentials

Symptom

After configuring my FME Flow (formerly FME Server) to use Active Directory you are able to login successfully using your windows credentials, however after enabling single sign-on when you try and login via the ‘Use Windows Credentials’ button it is unsuccessful, the page simply refreshes and you remain on the login window.

In the fmeserver.log (Resources>Logs>Core>Current) you see either of the following INFORM messages:

Failed login by user = due to insufficient credentials.

OR

Failed login by user Negotiate YIIH9wYGKwYBBQUCoIIH6zCCB....... due to insufficient credentials.

Cause

During SSO, an Authorization header is sent to FME Flow from the browser with user SSO credentials. If that header value finished with '=' everything would work as expected, however if it did not contain an equals character FME Flow was unable to process this token. The issue is somewhat random and depended on the username length and server configuration as to whether the header was returned with an '=' or not, only if the Authorization wasn’t a certain length, would it be padded with an = at the end, this means there is no workaround.

Resolution

This issue was introduced in 2019.1 b19594 and a fix went into 2019.2 b19797, if you are encountering this issue you will need to upgrade your FME Flow.