How to configure OpenID connect authentication with Okta on the TIBCO Spotfire Server

How to configure OpenID connect authentication with Okta on the TIBCO Spotfire Server

This article describes the steps to configure OpenID connect authentication with Okta on the TIBCO Spotfire Server.

1. Register an Okta account using the following URL : https://developer.okta.com/pricing/ and ensure to copy your Okta URL(For example: https://dev-186893.oktapreview.com/) after signing up.
2. Sign using your Okta URL with desired credentials

                    
       8. Go back to Okta portal and provide redirect URL. After application registration is complete, you can tweak the settings like Allowed grant types, Login initiated as per your needs. For example, below are adjustments that we have tested internally.

**Important Note**:
For TIBCO Spotfire Server versions 10.7 and below: Ensure to select the 'Login Initiated by' option to be "APP" instead of "Either Okta or App" as it is not applicable for Spotfire application because Okta can only initiate the login for Web and SPA apps with the "implicit" grant type where as Spotfire by default uses "Authorization code" workflow.

For TIBCO Spotfire Server versions 10.8 and higher: Spotfire now supports third party initiated login (https://community.tibco.com/wiki/whats-new-tibco-spotfirer-108#toc-31) which in the Okta case means that you could start an authentication flow by clicking the Spotfire app in the Okta portal.

To configure this you specify the following:

• "Login initated by": "Either Okta or App"
• "Login flow": "Redirect to app to initiate login (OIDC Compliant)"
• "Initiate login URI": https://example.com/spotfire/auth/oidc/v1/initiate

Due an Okta limitation (that has been reported and will hopefully be resolved soon) you also need to ensure that "Implicit (Hybrid)" is selected under "Allowed grant types" (Spotfire will still only use the Authorization Code flow).

                   Doc: Configuring OpenID Connect

• https://docs.tibco.com/pub/spotfire_server/7.11.0/doc/html/TIB_sfire_server_tsas_admin_help/GUID-74323530-6878-4741-A50E-22EDC233A2C0.html

External: Creating Okta account

• https://www.okta.com/

External: Implement the Authorization Code Flow

• https://developer.okta.com/authentication-guide/implementing-authentication/auth-code