TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Advanced Procedures
Servers will be down this weekend.
Mon, 08 Jan 2007 11:06:42 GMT
123455
9.20 Impersonation
What Is Impersonation?
When the cluster of TIBCO Spotfire Servers is used in conjunction with one or more
TIBCO Spotfire Web Player servers, which have been configured for certain
authentication methods, for example, NTLM, impersonation also needs to be enabled
on the TIBCO Spotfire Servers for seamless login.
Impersonation means that the TIBCO Spotfire Web Player is responsible for
authenticating users. Calls from the TIBCO Spotfire Web Player to the TIBCO
Spotfire Server cluster will be made on behalf of the person authenticated.
For example, consider that the TIBCO Spotfire Web Player server is configured for
certificate authentication. This authentication method is done on the https network
level and there is no user name or password which can be conveyed to the TIBCO
Spotfire Server cluster for login. Instead the TIBCO Spotfire Web Player server is
trusted for impersonation. The TIBCO Spotfire Web Player server is allowed to make
calls on behalf of any user without the ordinary authentication mechanism. This means
the user will see his/her specific files in the library etc.
Enabling impersonation can pose a potential security issue, which is why this is
disabled by default. To strengthen security there are a number of requirements that can
be imposed on a call in order for it to be allowed to impersonate.
9.20.1 Enabling Impersonation
To enable impersonation, you need to activate it from the TIBCO Spotfire
Configuration Console. There are a number of requirements that you can set up which
decides when to allow impersonation. These requirements are on the impersonate call
from a TIBCO Spotfire Web Player server to the TIBCO Spotfire Server cluster. All
the requirements you decide to set up must be met for the impersonation call to be
allowed.
If you want to require the impersonation call to be made on https, check the Require
SSL option. If you leave it blank, both http and https are allowed.
The call from a TIBCO Spotfire Web Player server to the TIBCO Spotfire Server
cluster will always require authentication. This is most often done as a certain user
which has been specified in the configuration of the TIBCO Spotfire Web Player
server. The TIBCO Spotfire Server cluster can be configured to only allow certain
users to be able to issue impersonation calls - typically the very user specified in the
TIBCO Spotfire Web Player server configuration.
TIBCO Spotfire® Server 3.2.2 125 (144)