TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Authentication and User Directory
8.3.3 NTLM
MIGRATING OR UPGRADING?
TIBCO Spotfire Server 3.2 introduces support for NTLMv2. You
should consider switching to "NTLM v1/v2" that supports both v1 and
v2. The instructions below explain how to set up this version, not the
old. If you wish to continue using "NTLM v1 only" you must copy the
files jcifs.jar and jcifs-ext.jar from /tomcat/
webapps/spotfire/WEB-INF/lib to /tomcat/
webapps/spotfire/WEB-INF/lib.
With this authentication method, users are authenticated with a Windows Domain.
Setting up NTLM authentication involves three steps:
1 Creating one or more computer service account in your Windows Domain.
2 Enabling NTLM authentication for your cluster in the Configuration Console.
3 Configuring NTLM in either the Configuration Console or on each Spotfire Server (or
both).
If you have only one server in the Spotfire system, you can configure all settings in the
Configuration Console. If you have more than one server, however, you must
configure some or all settings on each Spotfire Server.
Note: If you have a load balancer in front of your cluster, you must set up NTLM on
the load balancer rather than on the Spotfire Servers. See the section “NTLM
Authentication” on page 62 for more information about this.
Below are comprehensive instructions for each step.
Creating a Computer Service Account in Your Windows Domain
Creating computer accounts in a Windows Domain is done using the Microsoft
Management Console snap-in Domain Users and Computers. If you do not have
access to this tool, or if you are unfamiliar with how to use it, please speak to your
Windows Domain administrator.
In this tool, create a new computer account. See Microsoft documentation for details
on how to do this.
Note: Adding a real computer or re-using an existing account name will not work and
may cause problems for those accounts and computers. Always create a new account
by selecting “New computer account”.
When you have created a new computer account, you need to set a password for this
account. Unfortunately, this is not possible to do in the Microsoft Management
Console. In the directory /tomcat/bin there is a vbs script
called SetComputerPass.vbs. This is an example of how to run the script:
C:\> cscript SetComputerPass.vbs "cn=spotfireserveruser,cn=computers,dc=yourdomaincontroller,dc=yourorganization,dc=com"
TIBCO Spotfire® Server 3.2.2 75 (144)