TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Authentication and User Directory
For the servers to accept the client ceritificates, it must be told to trust the certificate of
the certificate authority that issued them. In order for this to happen, you must export
the certificate authority certificate (CA certificate) to file and import it to a truststore
that the Spotfire Servers can read. Once you have the CA certificate in a file on the
Spotfire Servers, issue the following command to create a truststore and import the CA
certificate to it:
/jdk/bin/keytool.exe -importcert -v -file -keystore
castore.jks.
clientAuth=”true”
The truststore file castore.jks can be placed anywhere. You must add the path to it, its
password and its type to the file server.xml. See the next step for instructions on how
to do this.
Configure a Server to Require Client Certificates
To configure a server to require client certificates you must edit the file server.xml,
located in the directory server installation dir>/conf.
In the Connector definition that you created when you configured the server to use
HTTPS, add the following:
You must also add the path to the truststore, its password, and type to server.xml. Also
within the Connector definition, add the following:
truststoreFile=
truststorePass=password
truststoreType=”JKS”
Configure a Load Balancer
To configure a load balancer to redirect client certificates, see the section “X.509
Client Certificate Authentication” on page 62
Configure the Servers to Use Client Certificates to Authenticate Users
To configure the servers in the cluster to use client certificates to authenticate users,
open the configuration console, select the tab called Authentication and select X.509
Client Certificate as the Login Method.
74 (144) TIBCO Spotfire® Server 3.2.2