TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Authentication and User Directory
8.3.1 Kerberos
Kerberos is a single sign-on protocol that sends encrypted user information from a
client across the network to the authentication server. Kerberos works in LDAP
environments and is considered to have strong security. If you intend to use Spotfire in
an environment where Kerberos is used, this may be a good way of increasing security
for the Spotfire system.
Note: In a clustered environment, there are certain considerations that must be taken
into account. For details about these, see the section “Kerberos Authentication” on
page 61.
There are several steps that must be taken to set up Kerberos authentication. The
following sections outline them step by step.
8.3.1.1 Prepare the LDAP Server
How to set up Kerberos with your LDAP server may differ significantly depending on
what LDAP server you are using. The instructions provided here will work for a
Windows Active Directory. If you are using a different LDAP solution, you may have
to provide different settings to the configuration files provided with the Spotfire
Server.
In order for the Spotfire Server to authenticate with a Windows Domain using
Kerberos, the Windows Domain must meet the following prerequisites:
• All Domain Controllers must run Windows 2003 Server SP1 or later.
• Microsoft Support Tools must be installed.
• All computers that will run Kerberos must belong to the same Windows
Domain.
• All computers in the domain must have synchronized clocks (this should happen
automatically when a computer becomes a member of a domain).
• All Spotfire users must have user accounts in the Windows Domain.
Note: If the Windows Server is an upgrade of a Windows 2000 server, the user
accounts may be using encryption mechanisms not supported by Spotfire. Please refer
to Microsoft documentation to get around this issue.
The following steps must then be performed:
1 Configure LDAP authentication for the Spotfire Server (see the section “LDAP” on
page 66 for instructions on how to do this). Make sure this is working as intended.
2 Create a Domain user to be the Spotfire service account. This should be a normal
domain user account, and should be named something easy to remember. Make sure it
meets the following requirements:
• Do not enter a First Name, Initial or Last name for the user account.
• Use the same information in the Full Name field as in the User Logon Name
field. Make sure there are no spaces in these fields.
TIBCO Spotfire® Server 3.2.2 69 (144)