Open topic with navigation

# Authentication

When authentication is enabled, FTL clients, eFTL clients, administrative tools, and other FTL servers must authenticate to the FTL server. They can authenticate to the FTL server in one of three ways:

- Basic authentication: The user provides a username and password.

- mTLS authentication: The user provides a TLS certificate and its corresponding private key. The FTL server verifies the client's certificate during the TLS handshake.

  Note: mTLS authentication is not supported for eFTL clients or the eFTL REST API.

- oauth2 authentication: The user provides a signed JWT token, or the URL of an oauth2 server that can issue a signed JWT token and also provide credentials for accessing that server.

For more details, see Authentication

FTL server supports various authentication providers. Each authentication provider has its own configuration and is used for exactly one of the authentication modes above (basic, mTLS or oauth2). The purpose of the authentication provider is to determine if the client has authenticated successfully and if authenticated to determine the client's username and authorization roles. In the case of basic authentication, FTL server can try each basic authentication provider until one succeeds, or they all fail.

The following are the supported authentication providers. More than one provider can be configured. However, duplicate providers are not allowed. For example, it is illegal to configure multiple flat file authentication providers, but it is legal to configure a flat file provider and an ldap provider.

- Flat File: Basic authentication only: A built-in provider within FTL server that reads a file of usernames and passwords. For details, see Using the Built in Flat-File Authentication Service

- LDAP:Basic authentication only. A built-in provider within FTL server that uses an LDAP server to authenticate clients. For details, see Using the Built in LDAP Authentication Service

- HTTP/HTTPS (customizable): Basic authentication only. FTL server makes HTTP/HTTPS calls to an external authentication service to authenticate clients. The authentication service may be completely customized by the administrator. For details, see Using the external custom HTTP / HTTPS based authentication service

- mTLS: mTLS authentication only: Enables verification of client certificates during a TLS handshake. For details, see Using the Built in mTLS Based Authentication Service

- oauth2: oauth2 authentication only: Enables verification of signed JWT tokens, plus enforcement of the token's expiration time under certain circumstances. For details, see Using the built in OAuth 2.0 based authentication service

Did you find this helpful?

Yes No
Great!
Thanks for taking the time to give us some feedback.
Sorry about that

Why wasn't this helpful? (check all that apply)

Could not find what I was looking for
Instructions confusing or unclear
Instructions did not work

Want to tell us more?

Please select at least one option or provide details about the issue!!

Error occurred while submitting feedback.

Error2 occurred while submitting feedback.

TIBCO FTL® - Enterprise Edition

Copyright © 2009-2024. Cloud Software Group, Inc. All Rights Reserved.