Configuring Anonymous Access to Analysis Files in TIBCO Spotfire 7.5 Introduction Use Cases for Anonymous Authentication Anonymous Authentication in TIBCO Spotfire 7.5 Enabling Anonymous Authentication on the Spotfire Server Enabling the special user guest@anonymous Granting Spotfire Licenses to the special user guest@anonymous Enabling Anonymous Library Folder access URL Linking Example JavaScript API Example Introduction The main shift from TIBCO Spotfire 7.0 and earlier versions to TIBCO Spotfire 7.5 is a seemingly simple architecture change: The TIBCO Spotfire Server is now the entry point and TIBCO Spotfire Web Player and TIBCO Spotfire Automation Services have become a set of scalable backend services. Figure 1 shows how the clients all connect to the Spotfire Server in order to be serviced. Figure 1 TIBCO Spotfire 7.5 Architecture - Clients Connect to Spotfire Server Other documents including the TIBCO Spotfire Server Installation Manual have detailed information about the architectural differences. This document focuses on just what is important in light of anonymous authentication to the Spotfire environment. Many customers want to embed TIBCO Spotfire Web Player into a portal or other web application and have these analysis files available to users who are not authenticated. In TIBCO Spotfire 7.5, since the Anonymous Authentication TIBCO Spotfire 7.5 Page 1
Spotfire Server is handling all client requests and authentication, there are a set of options that allow anonymous access to certain analysis files within the Spotfire Library. This document walks through the exact steps to expose one or more analysis files to anonymous users. Use Cases for Anonymous Authentication TIBCO Spotfire supports an almost unlimited set of possible configurations. For the purposes of this document, we have focused on the following major use cases: I want to... Allow users to open Spotfire Analyses without requiring users to login to Spotfire Web Player or passing login information in headers etc. Embed Spotfire Visualizations in my Web portal application using the Spotfire JavaScript API, without requiring users to login to Spotfire or passing login information in headers etc. Anonymous Authentication in TIBCO Spotfire 7.5 With the new Spotfire 7.5 architecture, setting up anonymous access is very simple and consists of the following steps: 1) Configure anonymous access as described in the TIBCO Spotfire Server Administration Manual in the section titled Configuring anonymous authentication 2) Grant the appropriate Spotfire Licenses to the special user guest@anonymous 3) Set the permissions on the Spotfire Library folder containing the Analysis File(s) to allow access by the special user guest@anonymous. The following section gives a step-by-step walkthrough using the example file Baseball that ships with Spotfire 7.5. Anonymous Authentication TIBCO Spotfire 7.5 Page 2
Enabling Anonymous Authentication on the Spotfire Server We will use the Spotfire Server Configuration Tool to enable Anonymous Authentication. The Configuration Tool is located under our installation folder. In my case the full path is: C:\tibco\tss\7.5.0\tomcat\bin\uiconfig.bat Once the Configuration Tool starts, we click on the Configuration tab, enable anonymous authentication and click on Save configuration : The Configuration Tool will prompt for where to save the new configuration. I select Database and click Next: Anonymous Authentication TIBCO Spotfire 7.5 Page 3
The Configuration Tool will prompt me for a suitable comment. I enter one and the click Finish: The Configuration Tool then reminds me that I will need to restart the Spotfire Server before my configuration changes take effect. You may see a slightly different message depending on how your Spotfire Server is configured. At this point I restart my Spotfire Server via the Windows Services Control Panel: Anonymous Authentication TIBCO Spotfire 7.5 Page 4
Enabling the special user guest@anonymous By default, this special user account is disabled when Spotfire Server is first installed. To enable it, we will use the command line version of the Configuration Tool. Open a windows command prompt and enter the highlighted commands. Enter the Configuration Tool password if prompted: cd c:\tibco\tss\7.5.0\tomcat\bin config enable-user -username=anonymous\guest Tool password: Successfully updated the status of user 'guest@anonymous' to enabled: true Remember: Your Configuration Tool may be in a different folder, so make sure to use the correct path for your installation. Anonymous Authentication TIBCO Spotfire 7.5 Page 5
Granting Spotfire Licenses to the special user guest@anonymous At this point, the special user guest@anonymous is enabled, but does not have any Spotfire Licenses. To grant Licenses we run Spotfire Analyst and select the Tools à Administration Manager menu item. Within the Administration Manager, if we search for the user guest@anonymous, we can see that they are a member of the group Anonymous User, and do not currently have any licenses granted: We will grant licenses at the group level so we switch to the Group and Licenses tab and select the Anonymous User group: Anonymous Authentication TIBCO Spotfire 7.5 Page 6
We click the Edit button and grant the TIBCO Spotfire Consumer and TIBCO Spotfire Enterprise Player licenses: Once done, we can switch back to the Users tab and confirm that our special user now has the required licenses: Anonymous Authentication TIBCO Spotfire 7.5 Page 7
Enabling Anonymous Library Folder access The last configuration step is to set the permissions on a Spotfire Library Folder to allow access by anonymous users. In our case we will create a new folder called Anonymous and set the permissions on that folder. From Spotfire Analyst, we open the Library Administration dialog by clicking on the Tools à Library Administration menu item. For our example we will create our new Anonymous Folder at the top level of our Library, the click on the Permissions Edit button to change the default Inherited Permissions: On the Folder Permissions Dialog: Deselect the checkbox Inherit permissions from Parent Folder Search and locate the group Anonymous User Add the group Anonymous User to the Browse + Access section Anonymous Authentication TIBCO Spotfire 7.5 Page 8
Clicking OK we can see the changes in permissions: Anonymous Authentication TIBCO Spotfire 7.5 Page 9
URL Linking Example For our example we will use the sample file Baseball. So in Spotfire Analyst we go ahead and open the file from its current location in the Library: Demo / Analysis File / Baseball / Baseball and save it to our new Anonymous folder: Anonymous / Baseball At the end of the Save operation, Spotfire responds with a dialog containing the Web Player URL for our new item: This is the link we will use in our example. The following example displays our Baseball sample embedded in an iframe in a blank web page, along with a link to open the visualization in a separate page. In my case, I created a file called linking_and_embedding_demo.html in the root folder of my IIS Web Server. I then placed the following code in the file: <html> <head> </head> <body> <iframe src="http://localhost:9090/spotfire/wp/openanalysis?file=/anonymous/baseball" height="450" width="800"></iframe> <p> <a href="http://localhost:9090/spotfire/wp/openanalysis?file=/anonymous/baseball" target="_blank">click here to open in a new page</a> </body> </html> Remember: You will need to update the server URL to reflect the path for your configuration. Anonymous Authentication TIBCO Spotfire 7.5 Page 10
Now if we open this example in our web browser, we can confirm that we can now access this URL without having to login: If we click on the link, it opens the visualization in a new tab, also without having to login: Anonymous Authentication TIBCO Spotfire 7.5 Page 11
JavaScript API Example The configuration above also allows us to use the Spotfire JavaScript API to embed specific pages from a Spotfire Analysis file into a web page. The following example displays the WinShares page from our Baseball sample into a blank web page. In my case, I created a file called mashup_demo.html in the root folder of my IIS Web Server. I then placed the following code in the file: <html> <head> <script type="text/javascript" src="http://localhost:9090/spotfire/wp/getjavascriptapi.ashx?version=7.5"> </script> <script> var c_serverurl = "http://localhost:9090/spotfire/wp/"; var c_analysispath = "/Anonymous/Baseball"; var c_parameters = ""; //Optional configuration block var customization = new spotfire.webplayer.customization(); var app; var c_reloadanalysisinstance = false; window.onload = function() { app = new spotfire.webplayer.application ( c_serverurl, customization, c_analysispath, c_parameters, c_reloadanalysisinstance); // Hide UI elements customization.showdodpanel = false; customization.showstatusbar = false; customization.showtoolbar = false; customization.showpagenavigation = false; customization.showclose = false; customization.showanalysisinfo = true; customization.showexportfile = true; customization.showexportvisualization = true; customization.showundoredo = true; customization.showfilterpanel = true; } </script> </head> <body> var viewone = app.opendocument("demoviz", "Win Shares", customization); Anonymous Authentication TIBCO Spotfire 7.5 Page 12
<div id="demoviz"></div> </body> </html> Remember: You will need to update the script path and the server URL to reflect the paths for your configuration. Now if we open this example in our web browser, we can confirm that we can now access this URL without having to login: Anonymous Authentication TIBCO Spotfire 7.5 Page 13