TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Authentication and User Directory
• Check the box Password never expires. All other boxes should be unchecked
(Note: Make sure to uncheck User must change password at next logon).
• If you intend to use Kerberos for database authentication (see the section
“Database Authentication using Kerberos” on page 91), you must also set
Account is trusted for delegation found on the Accounts tab of the Properties
dialog. This setting has certain security issues, and therefore you should only set
it if you intend to do this.
Next, you must create two Service Principal Names needed for the authentication.
This requires Microsoft Support Tools. Refer to its documentation for more
information about this and other tools included in the package.
Note: In a load balanced environment, you need to create two Service Principal
Names for each Spotfire Server, and two for the load balancer. You must map all of
them to the same service account.
Creating Service Principal Names (SPNs)
Executing the following commands on one of the Windows Domain Controllers:
> setspn -A HTTP/myHost.mydomain[:port] myServiceAccount
> setspn -A HTTP/myHost[:port] myServiceAccount
Replace the myHost myServiceAccount, and mydomain variables with values
appropriate in your environment.
Note: If you use port 80, do not specify port number.
Example:
Setting SPNs for the service account "spotsvc" and the computer
spotserver.research.example.com using the HTTP port 8080.
> setspn -A HTTP/spotserver.research.example.com:8080 spotsvc
> setspn -A HTTP/spotserver:8080 spotsvc
This would result in the following two SPNs:
• HTTP/spotserver.research.example.com:8080
• HTTP/spotserver:8080
Note: All usernames, hostnames, and domain names are case sensitive. Take special
care when running the commands and editing the files below.
After you have run these commands, you can verify your setup with the command:
> setspn -L myServiceAccount
Example:
Verifying SPNs for the service account “spotsvc”.
> setspn -L spotsvc
Registered ServicePrincipalNames for
CN=spotsvc,CN=Users,DC=research,DC=example,DC=com:
70 (144) TIBCO Spotfire® Server 3.2.2