Home
Introduction to Security
Manage user roles and security for Spectrum Spatial and Spectrum Spatial Analyst.
Security for the Technology Platform
Web Service Authentication
Spectrum Technology Platform web services require authentication with valid user credentials. There are two methods for authenticating: Basic authentication and authentication by token.
Disabling Host Checks in Token Authentication

Welcome
What is Spectrum Spatial?
Getting Started
Learn about Spectrum Spatial.
Administration
Configure, manage, monitor, troubleshoot, and tune the performance of your system.
Introduction to Security
Manage user roles and security for Spectrum Spatial and Spectrum Spatial Analyst.
- Managing Security
- Security for the Technology Platform
  - Security Model Overview
  - Users
    Spectrum Technology Platform user accounts control the types of actions users can perform on the system.
  - Roles
    Spectrum Technology Platform comes with these some predefined roles.
  - Limiting Server Directory Access
    You can browse the Spectrum Technology Platform server's folders when performing tasks that require them to select a file. For example, users can browse the server when selecting an input or output file in a source or sink stage in Spectrum Enterprise Designer.
  - Enable HTTPS in Spectrum
    By default the Spectrum Technology Platform server uses HTTP for communication with Spectrum Enterprise Designer, browser applications such as Spectrum Management Console and Metadata Insights, as well as for handling web service requests and API calls.
  - Web Service Authentication
    Spectrum Technology Platform web services require authentication with valid user credentials. There are two methods for authenticating: Basic authentication and authentication by token.
    - Disabling Basic Authentication for Web Services
      Spectrum Technology Platform supports two types of authentication for web service requests: Basic authentication and token authentication. By default, both methods are enabled.
    - Disabling Authentication for Web Services
      Service-level authentication can be disabled for all SOAP or REST web services (or both). This is useful if you have your own high-level authentication built into the solution that is using, for example, Spectrum Spatial services.
    - Enabling CORS
      Cross-Origin Resource Sharing (CORS) is a W3C standard that allows data sharing between domains. CORS enables web applications running in one domain to access data from another domain.
    - Disabling Host Checks in Token Authentication
  - Using LDAP or Active Directory for Authentication
    Spectrum Technology Platform can be configured to use an LDAP or Active Directory server for authentication.
- Security for Spatial
- Security for Spatial Analyst
Resources and Data
Learn how to work with spatial and routing data using named resources.
Managing Spatial
Manage the Spectrum Spatial repository and Spectrum Spatial Analyst deployments using Spectrum Spatial Manager.
Development
Learn how to incorporate spatial and routing functionality into your solutions.
Stages
Learn about the spatial and routing stages available for dataflows in Spectrum Enterprise Designer.
Services
Learn how to access spatial and routing services from your applications.
Utilities
Take advantage of the productivity tools that Spectrum Spatial has for working with spatial data.
Reference
Information about Spatial Java properties, MapInfo SQL language, and closest arc snapping when calculating routes.

Disabling Host Checks in Token Authentication

In token authentication, the Spectrum Technology Platform server examines the token presented by the client before responding to the request. The server checks the token to see if it has expired, if it is encrypted correctly, and if it is from the correct host. For session tokens, the server also checks the session ID. If any of these checks fail, the token is rejected and the server does not respond to the request.

In a clustered environment, it is possible that requests may be redirected in a way that makes the request appear to be coming from a different host than is specified in the token, resulting in "invalid token" errors. For example, say you have a cluster with two nodes as shown here:

Let's say that the client makes a request and is the request is routed to Node 1. A token is created and tied to host 2.2.2.2 (the load balancer) since the node views the request as coming from the load balancer. If the next request from the client is routed to Node 2, the token will still be tied to host 2.2.2.2 but the request will appear to be coming from the proxy server, 3.3.3.3. In this case the node will reject the token because it appears that it is not associated with the host making the request.

In this situation you must configure the Spectrum Technology Platform server to ignore the host information included in the token. This should only be done if you have an environment where there are different network devices between the load balancer and the nodes. If all nodes are behind the same network device, there is no need to disable the host check.

Note: If you follow this procedure, client tokens become "open" tokens, since the host check is disabled. Session tokens will continue to be associated with a specific session ID, but not with a specific host.

Open the following properties file on the Spectrum Technology Platform server:

SpectrumDirectory/server/conf/spectrum-container.properties

Set the following property to false.

spectrum.security.authentication.token.remoteClientCheck.enabled=false

Save and close the properties file.
Repeat this process on all the nodes in the cluster.