TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Advanced Procedures
9.17.5.4 Using Kerberos Authentication with Delegated
Credentials
Before configuring JDBC Data Sources for Kerberos authentication with delegated
credentials, it must be verified that it is possible for clients to connect to the Spotfire
Server using Kerberos authentication. When the server is correctly set up and
everything works, it is time to proceed to the next step.
To set up Information Services to use delegated Kerberos credentials when making
connections to database servers, the Spotfire Server’s service account used for
retrieving the ticket-granting ticket (TGT) must be given the permission to delegate
client credentials. In the “Active Directory Users and Computers” control panel on the
domain controller, the “Account” tab of the properties dialog for the service account
contains an “Account is trusted for delegation” check box that can be checked to give
the service account that permission.
After setting up the service account’s delegation rights, a new JDBC Data Source must
be created in the data source template xml. Copy a non-Kerberos definition for the
same type of data source and add the special JDBC connection property
“spotfire.connection.pool.factory.data.source” with the value “kerberos.data.source”.
All JDBC connection properties required to configure the JDBC driver for Kerberos
authentication should also be added. Please consult your database server’s
documentation for more information about configuring the JDBC driver.
Example: Setting up Kerberos authentication with delegated credentials for an Oracle
database
oracle-kerberos
Oracle Kerberos
oracle.jdbc.OracleDriver
jdbc:oracle:thin:@<host>:<port1521>:<sid>
SELECT 1 FROM DUAL
spotfire.connection.pool.factory.data.source
kerberos.data.source
oracle.net.authentication_services
(KERBEROS5)
...
9.17.5.5 Verifying a Data Source Template
To verify the data source template from TIBCO Spotfire:
120 (144) TIBCO Spotfire® Server 3.2.2