Spotfire Web Client: Users may get logged out unexpectedly upon Absolute Timeout or Kerberos ticket refresh

Details:

The Spotfire Web Player is designed such that end user's browser sessions should not experience any interruption when Spotfire needs to extend the session. This could happen in at least two scenarios, when single-sign-on (SSO) is configured:

1) Absolute Timeout (24 hours after login, by default), and 

2) Kerberos ticket is about to expire.

In both of these cases Spotfire takes action in the background, such that the end user should not see any effects in their browser.

When users experience this defect, they will become logged out and then will see the following message:  "Your session has ended. Thank you for using TIBCO Spotfire."

Another possible experience of this defect is that the user remains logged in, but after applying markings or filtering to a DXP, then the display of the DXP becomes blank or reverts back to the most recently persisted state.

The entry shown below, from the Spotfire server log file, indicates that the Kerberos ticket that the current session uses is going to expire soon, so Spotfire is going to request a new one. This log entry indicates the above scenario 2:

"The delegated Kerberos credentials are about to time out in 1758 seconds."

Solution:

A defect was identified and fixed in releases 12.0.10 and 14.0.2 of the Spotfire server. Below is the Spotfire issue in the Jira tracking system:

TSS-33511: When re-authentication is triggered due to an absolute session timeout or due to Kerberos credentials that are about to expire, the Web Player session closes.

If this issue is observed with higher Spotfire versions beyond 12.0.10 and 14.0.2 please report it to Revvity Signals Support.