How to bypass the IWP login page

Since v8 FileMaker® Server Advanced got a new IWP login page.

It's better than the previous authentication scheme in a number of ways. The most important one is that you can use non-romanized account names for non-English applications. If you application is entirely in Russian or Japanese, romanized account names look quite awkward. With FileMaker 8 romanized ‘Petrov’ and ‘Ueda’ can be changed to real ‘Петров’ and ‘上田’.

Yet it also has some disadvantages. Though you can customize the IWP home page, there's no instructions on how you can place the authentication form on this page and save your users a few clicks. If you want to allow both guests and authenticated users, guests will have to go through the same authentication page as well. The form is implemented in such a way that users can no longer have their browsers to remember the login and password. Unless they use some other password management utility like KeePass, they will have to type both their login and password every time. As I see this is intentional (the form has the autocomplete attribute explicitly set to off), but such a strict policy is not always necessary.

On FileMaker Forums I've seen some requests about this problem. There are also answers, but none of them gives a complete solution and some suggestions are a bit too complex. So here are exact recipes that work.

---

In all the examples I used the FMServer_Sample file that comes with FileMaker Server as the sample file to log in to. The HTML internals are shown on screenshots, but, of course, I have a sample file with all the code.

Log in to a file via form

As [Guest]:

As an authenticated user:

In both cases the file name is in the dbpath param:

Change it if you need to log in to another file.

Log in to a file via link

As [Guest]:

As an (predefined) authenticated user:

As you see it's simply a mechanical transformation of the forms. The only thing that requires special attention is the dbpath parameter: you have to encode reserved, non-ASCII and “unsafe” characters.

Check this if you need more information on URL encoding.

---

Don't forget to grab the sample file :) Next post (Dec 22, 2006): Miscellaneous development tips.

Comments

[Mogens Brun]

Thanks for your examples. They use a couple of special terms like "-startsession" and "-authdb". Do you know which part of the FileMaker Web Publishing system interprets this terms - and which other terms are available, their syntax etc? Maybe they could be used for some control of the web publishing system?

Best regards Mogens Brun
FM Integrator

[m.edoshin]

I extracted these parameters from the source code of the IWP login page with some help of Firefox DOM Inspector, I think. There can be some other parameters, but I have no idea where to get them :) except that from other IWP pages maybe. This would be a rather tedious job though.

[icarux]

Thanks for this explanation but is there some way to make this url emailable?

I've gotten my direct login test url working in a web page but when I copy the url to an email (or a web browser address bar) it does not work.

Ive tried the unencoded and encoded (%2F, etc.) versions and neither work.

I don't understand why this will work as a clickable link but not a direct url.

[Rob McLear]

This is great! Thanks so much for the help, this is working so well for our users to more easiliy access the databases.

The only issue we have found is if a user tries to access a 2nd database during the same browser session; they end up back in the original database. I'm guessing this is a cookie-related issue? Is there any way to force clearing the cookies and starting a new session?

Thanks again for your help!

-Rob McLear

[Nick]

Did anyone manage to get round the cookie problem?

[m.edoshin]

To icarux: try replace in the URL with actual ampersands.

To Rob and Nick: if the user logs out the first database using the button on the status area then he/she will be able to connect to another just fine. Does this solve the problem?

[John May]

I've used some Lasso code in custom login pages before to clear out the cookies - works great!

Here it is:

[cookie_set: 'http-session'='', -expires='-1', -path='/fmi/iwp']
[cookie_set: 'fmi-cookie'='', -expires='-1', -path='/']

- John

[Shaun Kilbride]

With regards to the cookie solution, how is this code implemented? Where abouts in my html page do I use this code?

[Steve St-Laurent]

Does this login bypass solution still work in FMSA 9? I keep ending up on the IWP home page.

[Paul Spafford]

It works! Absolutely brilliant, Mikhail!

Someone from Technet directed me here when I asked how to do this. Thanks so much!

Paul

[David Kreisberg]

I tried implementing this technique to login as a guest and a user with an account. It worked great when I tried to connect to only one database, but when I created links to two separate databases odd things happened. whichever database link I used first in a session was the one I was redirected to when I clicked on the 2nd link. If I switched to a different browser and started w/ the 2nd link, that was the database that was opened when I clicked on the first link. Any help on insight will be appreciated. Here are pages w/ the links to the Video Resource Database and the Claims Database:

http://www.montgomeryschoolsmd.org/departments/development/index.shtm

http://www.montgomeryschoolsmd.org/departments/development/teams/admin/admin1.shtm

[m.edoshin]

Hi David,

Sorry, I tried to see why this may happen and what could be the remedy, but didn't spot anything.

Since these links appear to be public, why not to simply allow guest access to these files?

[Chris Attkins]

Thank you so much for sharing this neat workaround Mikhail. It has solved a problem for a new shared database in one go!

[David Kreisberg]

We originally had both database set for guest access, but we still had the problem of the 2nd link redirecting to the 1st database. Very puzzling.

[bharvey]

Great work around! I am using this with Filemaker 9 Advanced Server (OS 10.5) and it works as advertised. The only issue I can't seem to get right is on Logout from IWP, I am returned to the iwp_home.html page. So I replaced the default page with the new page based on your schema. This works great, but I can't display any graphics on this page. I've tried hard coding the path to the image, but this doesn't work either. Any idea how to code an img src (or where to locate the image file) to show on the iwp_home.html custom page?

Your solution is much better than the other ideas that are out there. Thanks for sharing this.

[Omar Cabello]

I cannot Log in to a file as an (predefined) authenticated user via link. This is what I am using:

http://localhost/fmi/iwp/cgi?dbpath=%2Ffmi%2Fiwp%2Fcgi%3F-db%3DEstimate_Tracker%26-startsession&acct=account&name=test&password=&login=test&-authdb

For local host I am using our internal ip address of the filemaker server
Account Name = test
Password = test

Any thoughts?

[m.edoshin]

I think what's missing is the “test” password. It should be right after “password=”.

[Jenifer Bracewell]

We would like to be able to pass other parameters to an IWP application, such as a record number, so that users can be dynamically directed to a record when they log in. Does anyone have any ideas on how this might be done via a URL?

[Aaron]

Thanks Mikhail! I've been agonizing over how to do this. You are awesome!

Jenifer, not sure how you'd do it via URL, but you can set a start script in the FMP database to take users to a particular record when they log in. You can even make it send a particular user to a particular record depending on info in your database or based on group privileges.

[Jacob Nicolaisen]

Thanks, a great page you are running.

What if I want at link to force the username, but not the password?

[m.edoshin]

You can hardcode only one option and let user fill in another. It's a bit harder to do with a link, but with a form it's simple: you hide the “name” input using the "hidden" attribute (cannot post HTML codes here) and leave only the password. With a link it would require some JavaScript to work, I think.

[Joel Englander]

Hi,

I would like to know, how to pass a script parameter in an IWP URL ???

I need that my opening script, would analyse the script parameter.

Sincerely, Joel.

[m.edoshin]

Hi Joel,

I don't think its possible. That is opening IWP is roughly same as opening a file in FileMaker itself. It can run a startup script, but cannot accept a parameter for it. You'd need something CWP-like for this.

Kind regards, Mikhail.

[Joel Englander]

Mikhail,

If I do something in CWP,
how do I get back in my IWP Site with my parameter ???

I have tried to make an other IWP FM File, with an opening script, that execute an external script with the parameter, and that is suppose to put me on the correct layout (on the regular FM File); but on the web it doesn't switch from on page to another !!!

Have you ever try to do that ??? Do you know the Solution ???

Sincerely, Joel.

[m.edoshin]

No, I don't know how to solve this. What kind of parameter is it? Is it something that can be deduced from the user name or something else that can be read with Get() functions (e.g. different layouts for FM and web clients)?