TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Authentication and User Directory
HTTP/spotserver:8080
HTTP/spotserver.research.example.com:8080
Create Keytab Files
The next step is to create keytab files, which the Spotfire Server(s) will use to
authenticate using Kerberos. This is also done with a tool that comes with Microsoft
Support Tools, called ktpass.exe. You can run this command on one of your Domain
Controllers and then copy the created files to the Spotfire Server(s).
Note: In a clustered environment, create one keytab file, and use the long principal
name of the load balancer, not one of the Spotfire Servers.
Always name the file spotfire.keytab, as shown below. Run the command, including
all the text on one line, like this:
> ktpass /princ HTTP/myHost.mydomain[:port]@MYDOMAIN
/mapuser myServiceAccount /ptype krb5_nt_principal /crypto rc4-hmac-nt
/out spotfire.keytab /pass Password
Replace the myServiceAccount, myHost
appropriate values.
mydomain, and Password variables with
Example:
Generate a keytab file for the Spotfire server spotserver.research.example.com running
on port 8080 in the Windows domain RESEARCH.EXAMPLE.COM (note the upper
case) with the password Pa55w0rd:
> ktpass /princ HTTP/spotserver.research.example.com:8080@RESEARCH.EXAMPLE.COM
/mapuser spotsvc /ptype krb5_nt_principal /crypto rc4-hmac-nt
/out spotfire.keytab /pass Pa55w0rd
Install Keytab Files
Once the keytab files are created with the above examples you need to install them on
the Spotfire Servers. For each Spotfire Server, the keytab file should be placed in the
directory
/jdk/jre/lib/security/
Note: This file contains important security information that should not be shared. It is
recommended that you use caution when copying the files to the destination servers. If
possible, a memory stick or similar should be used to avoid insecure network file copy.
You should also limit access to the file once in place. Only the Service and the
Administrator accounts on the Spotfire Server need to be able to read and write to it.
Also note that if, at any point, you change the password for Spotfire service account,
Kerberos will stop working and you will have to re-create the keytab files with the
new password.
8.3.1.2 Configure the Spotfire Server(s) to Use Kerberos
To enable Kerberos on the Spotfire Server(s) there is one configuration file that needs
to be modified. This chapter will outline what changes need to be made to this file. For
complete reference of the file, see the section “krb5.conf” on page 137.
TIBCO Spotfire® Server 3.2.2 71 (144)