TIBCO Spotfire Server
The Spotfire Server is the central component of the Spotfire environment, to which all Spotfire clients connect.
These tables provide reference for the security considerations for the Spotfire Server.
Spotfire Server component | Description |
---|---|
Service account | By default, the service is installed under the root account (on Linux) or NT AUTHORITY\System (on Windows). |
Ports and protocols | External communication port:
|
Logs | <spotfire server root>/tomcat/logs, See Spotfire server logs. |
Type | (Default) location | Comments |
---|---|---|
Spotfire library exports | <spotfire server root>/tomcat/application-data/library/ | Default library export path. Can contain old export or backups of library content. |
Spotfire server logs | <spotfire server root>/tomcat/logs | See Logging and monitoring. |
Spotfire temporary attachments | <spotfire server root>/tomcat/temp/AttachmentManager | Encrypted attachments. Temporary storage for data uploaded and downloaded to the server by Spotfire clients. |
Encrypted Spotfire database password for Spotfire Server | <spotfire server root>/tomcat/webapps/spotfire/WEB-INF/bootstrap.xml | Used by Spotfire server during startup process to connect to database. |
Spotfire library data | External library storage location, S3 or local file system, or in Spotfire database. | Only used if enabled. Default setting is to store library data in the Spotfire database. |
HTTPS keystore password | <spotfire server root>/tomcat/conf/server.xml | If HTTPS is enabled, server.xml contains the password to the keystore (pkcs12 or jks) that contains the private certificate required to create a HTTPS listener. |
Keystore for HTTPS certificates | <spotfire server root>/tomcat/certs | PKCS12 (.pfx) or Java keystore (.jks) with private keys needed for HTTPS configuration. |
Password hashes for end users | Spotfire database | Users' password hashes needed when Spotfire database is used as the authentication source. Default algorithm since Spotfire Server 7.5 is PBKDF2 (using HmacSHA512), 100000 iterations, 32 bytes of salt. Older algorithm still supported for upgraded system. From version 3.3 to 7.5: SHA-512, 2323 iterations, 16 bytes of salt. Default in 3.0 to 3.2: SHA-1, one iteration. |
Encryption password | <spotfire server root>/tomcat/webapps/spotfire/WEB-INF/boostrap.xml | The password is stored encrypted using AES-128 symmetric encryption using a static secret key. The password is used to encrypt service accounts passwords stored in Spotfire database. See config-encryption. If not set, a static password is used. |
Service account passwords | Spotfire database and configuration.xml | Passwords for service accounts for services such as LDAP configuration, S3 configuration, OpenId Connect, Action Log database are encrypted AES-128 using an encryption password as secret key.
Note: configuration.xml is an exported copy of the effective configuration that resides in the
Spotfire database. The file can safely be removed from the file system after having changed the
Spotfire configuration in the database
|
Information services data source credentials | Spotfire database | Credentials for data sources used by information services (created using the Spotfire Analyst > Information Designer tool) are encrypted AES-128 using an encryption password as secret key. |
Hashed passwords for JMX users | Spotfire database | If JMX is used, users credentials are stored in the Spotfire database. |
Kerberos keytab | <spotfire server root>/Spotfire.keytab | Used if Spotfire is configured for Kerberos authentication. The keytab file contains encrypted credentials that can be used to authenticate to remote systems. |
Spotfire Server Backend trust keystore | <spotfire server root>/nm/trust/keystore.p12 | Keystore needed for back-end trust encrypted TLS communication. The keystore is locked with a static password. |
Passwords embedded in Spotfire files | Spotfire database (library) | The
Spotfire database may contain
Spotfire files (.dxp) with embedded credentials to data sources. Passwords are not encrypted because the password must be made available to end users who access the file. We do not recommend embedding credentials in the file. The preference
EnableAllowSavingDatabaseCredentials can be used to disable the option to embed credentials in
Spotfire files.
|
Library exports | <spotfire server root>/tomcat/application-data/library | Can contain zip-files containing exported library content. Data source passwords for information services data sources are not included in the library exports. However, Spotfire analysis files (.dxp) in the exported zip can contain embedded passwords. |
Database installation script | No default location. From where they were run | Database installation scripts will contain credentials and connection information to the Spotfire Server database when they are run. These files will contain sensitive information and should be deleted when no longer needed or stored in a safe location |
OAuth2 API Clients credentials | The credentials are encrypted. |
- Spotfire Server Security Configuration and Administration Activities
This table provides information about configuration activities, security settings, and links into the documentation and community site. - Changing a Windows Service Account for Spotfire Server
The service account running the Spotfire Server under Windows can be changed to a user with more restricted rights. - Change a Linux Service Account for Spotfire Server
Spotfire Server for Linux provides two different installation methods: an RPM-installer and a tarball. You can use the tarball to install and configure to run as any user. - HTTPS (TLS over HTTP) for Front End Port
The file <spotfire server root>/tomcat/conf/server.xml contains the TLS configuration for the HTTPS. - Security HTTP Headers
The HTTP headers listed in this topic can be set using Spotfire configuration settings.
- Spotfire Server Security Configuration and Administration Activities
This table provides information about configuration activities, security settings, and links into the documentation and community site. - Changing a Windows Service Account for Spotfire Server
The service account running the Spotfire Server under Windows can be changed to a user with more restricted rights. - Change a Linux Service Account for Spotfire Server
Spotfire Server for Linux provides two different installation methods: an RPM-installer and a tarball. You can use the tarball to install and configure to run as any user. - HTTPS (TLS over HTTP) for Front End Port
The file <spotfire server root>/tomcat/conf/server.xml contains the TLS configuration for the HTTPS. - Security HTTP Headers
The HTTP headers listed in this topic can be set using Spotfire configuration settings.
Parent topic: Components
Related concepts
Related reference
Related information