Credentials profiles for connectors

Introduction

To be able to use a credentials profile in a data connection, the following is required:

In the service configuration, set the connector's authentication mode to WebConfig.
Create a credentials profile with credentials for the external data source, and add it to your Spotfire services.
In Spotfire Analyst, open your analysis file, and configure the data connection to use the credentials profile for authentication in web clients.

Creating a credentials profile

A credentials profile consists of a profile name, and a username and password for the external data source. Optionally, you can specify a list of allowed servers and/or connectors as conditions for what you can use the credentials profile for.

Write your credentials profile in the following format.

Example

<entry profile="credentials_profile_name">
   <allowed-usages>
      <entry server-regex="database\.example\.com" />
      <entry connector-id="Spotfire.GoogleAnalyticsAdapter" />
   </allowed-usages>
   <username>my_username</username>
   <password>my_password</password>
</entry>

Note: Spotfire connectors only require that the user has read privileges in the database. When you create a credentials profile, a recommended practice is to use a database user that only has the minimum required privileges for reading the data that you want to analyze in Spotfire.


Setting	Description
`entry profile`	The name of the credentials profile. The name is used to select the credentials profile for authentication in connection data sources. Note: For credentials profiles stored as files, the filename is the profile name.
`allowed-usages`	A list of allowed servers and connectors. You can use the credentials profile for authentication only in connections to the allowed servers, or with the allowed connectors. If allowed-usages is empty, you can use the credentials profile for authentication in connections to any server. Enter allowed servers as regular expressions, in the following format: `<entry server-regex="database\.example\.com" />` CAUTION: Make sure to specify the allowed servers as valid regular expressions. Values that are not valid regular expressions are ignored. If all servers are invalid, the credentials profile can be used in connections to any server. You can also enter allowed connectors. Then you can use the credentials profile for authentication in any connection that you created with that connector. For example: `<entry connector-id="Spotfire.GoogleAnalyticsAdapter" />` You can also specify both a connector id and a server in one allowed-usages entry, to require a specific combination of connector and server. For example: `<entry connector-id="Spotfire.SqlServerAdapter" regex="database\.example\.com">`
`username`	The username to use for authentication with the data source. Note: For integrated security, the username should be in the `DOMAIN\user` format, for example `EMEA\SalesUsers` or `EMEA\ExecUsers`. The profile is an arbitrary string.
`password`	The password to use for authentication with the data source.

Adding a credentials profile to services

You store credentials profiles on your Spotfire services, as part of the configuration or as files. You can add a credentials profile in the following ways:

Add a credentials profile to the setting DataAdapterCredentials, available in the service configuration file Spotfire.Dxp.Worker.Host.exe. See Manually editing the service configuration files.
Add a credentials profile as a file on the computer that runs the service. The filename is the profile name, and the file should have no file extension. Place the file in the directory determined by the setting DataAdapterCredentialsFilesDirectory, available in the service configuration file Spotfire.Dxp.Worker.Host.exe.

Note: If there is a credentials profile with the same name in the service configuration and in a file, the profile in the file in the DataAdapterCredentialsFilesDirectory directory takes precedence.