Custom authentication
The Spotfire Server provides an implementation of the
com.spotfire.server.security.CustomAuthenticator interface
which supports JWT access tokens that adhere to the RFC 9068 specification; the
Rfc9068AccessTokenCustomAuthenticator.
About this task
Procedure
- Enable External Authentication on the server using the configuration tool or the command line command config-external-auth.
-
As the
Source, select
Custom Authenticator and provide the fully
qualified class name
com.spotfire.server.security.Rfc9068AccessTokenCustomAuthenticator. -
Provide the initialization parameters of your choice:
source_type: where to retrieve the token from. Supported values areattribute,headerandcookie. The default isheader.source_name: the name of the attribute/header/cookie containing the token.source_regex: optional. A regular expression that can be used for retrieving the actual token from an attribute/header/cookie value that contains more things (the contents of the first capturing group will be used).metadata_uri: the URI to an OAuth2 metadata document. Mandatory unlessexpected_issuerandjwksorjwks_uriare specified.expected_issuer: the expected issuer of the token. Mandatory unlessmetadata_uriis specified.jwks: a JWKS with the public key needed to verify the signature. Mandatory unlessmetadata_uriorjwks_uriis specifiedjwks_uri: the URI to a JWKS with the public key needed to verify the signature. Mandatory unlessmetadata_uriorjwksis specifiedjws_alg: the expected signature algorithm. Optional (if not specified then any algorithm will be accepted).max_clock_skew_seconds: the maximum clock skew (in seconds) to be accepted when verifying timestamps. Default is 60 seconds.validate_audience: true if the audience of the token should be validated. If theexpected_audienceis defined, the token received is validated against the value inexpected_audience; if noexpected_audienceis specified, the validation is done against the public address of the Spotfire Server. Set to false to not validate the audience. The default is true.expected_audience: the expected audience. Optional.username_claim: the claim from which to extract the username. Default issub.email_claim: the claim from which to extract the email address. Default is no value.display_name_claim: the claim from which to extract the display name. Default is no value.domain_option: the way the domain of the user is determined. Supported values are:use_domain_claim,use_static_domainandparse_username_claim. The default isuse_domain_claim.domain_claim: the claim from which to extract the display name. Default isiss.domain: the name of the domain to use. Mandatory if the value ofdomain_optionisuse_static_domain.