TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Authentication and User Directory
For more information on how to use the Configuration Console, see its help.
Note: When configuring Kerberos authentication in a load balanced environment,
provide the fully qualified Service Principal Name of the load balancer, not any of the
Spotfire Servers.
8.3.2 X.509 Client Certificate
With this authentication method, users are authenticated through an automatic
transcript of an X.509 Client Certificate from the Spotfire client to the Spotfire Server.
When users log in using this method, their usernames are automatically stored in the
Spotfire database, and instead of passwords, the certificates are used, creating a single
sign-on solution. A prerequisite of this authentication method is that the Spotfire
Server, or the load balancer, if present, must be configured to use the HTTPS protocol
to communicate with the clients. See the sections “Setting up HTTPS on a Spotfire
Server” on page 86 and “Load Balancer Configuration” on page 60 for more
information about this.
To configure Spotfire to use X.509 Client Certificates, the following steps must be
performed:
1 Obtain or create a client certificate.
2 Install the certificate onto clients.
3 Configure a server to trust the client certificates.
4 Configure the servers to require client certificates.
5 Configure a load balancer, if present, to forward the client certificates to the server.
6 Configure the servers to use client certificates to authenticate users.
Note: If you perform only steps 1 through 4, the server will require client certificates,
but can still be configured to use a username and password login mechanism. If
required, this would provide a very secure solution.
Obtain or Create a Client Certificate
How to obtain or create a client certificate is different for every provider. Please turn to
your provider for information about this. In the section “Creating and Installing a Self-
Signed Client Certificate” on page 95, an example of how to create a self-signed
certificate using Microsoft Certificate Services is outlined.
Install the Certificate onto Clients
Installing a certificate is normally done with Internet Explorer on the client. By
connecting to the web page of the certificate provider, it should be possible to select to
install the certificate. See the section “Creating and Installing a Self-Signed Client
Certificate” on page 95 for an outline of how to do this with a self-signed certificate
created by Microsoft Certificate Services.
Configure a Server to Accept the Client Certificates
TIBCO Spotfire® Server 3.2.2 73 (144)