LiveView Authentication and Authorization

Refer to Using TLS/SSL with LiveView Server for instructions on how to enable TLS for LiveView.

Configure user names, passwords, and roles for each user in a configuration file with HOCON type security using configuration class LocalAuthenticationRealm. The role names are defined in a separate file discussed below. The spelling of role names in this file must exactly match those in the role definition file.

name = "localrealmusers"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"

configuration = {
  LocalAuthenticationRealm = {
    Principals = [
      {
        userName = "admin"
        password ="admin"
        roles = [ "LVAdmin" ]
      }
      {
        userName = "lvintern"
        password = "secret1ve"
        roles = [ "LVInternal" ]
      }
      {
        userName = "guest"
        password = "guest"
        roles = [ "LVGuest" ]
      }
      {
        userName = "tester"
        password = "tester"
        roles = [ "LVUser" ]
      }
    ]
  }
}

Configure the mapping of roles to LiveView privileges in a configuration file with HOCON type security using the root object, RoleToPrivlegeMappings. Notice that this configuration type is the same security HOCON type as in the Local Users file described previously, but has a different root object (which is the first keyword after configuration). For this reason, the Role settings can optionally go into a separate HOCON file; it would also be valid to place both configuration classes in the same file.

LiveView privilege names are shown in the LiveView Privileges section below. Each role can be assigned one or more privilege settings. User names with multiple roles inherit the privilege settings from all assigned roles.

A privilege specification without a resource entry means that the specified privilege applies to all features of the LiveView server. A resource line restricts the associated privilege to the specified resource, such as to a named table in this LiveView project, or to the input stream of a table.

The following example is abbreviated from the roleMappings.conf file provided in the LiveView Authentication sample included in LiveView.

name = "role-priv-mappings"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"

configuration = {
  RoleToPrivilegeMappings = {
    privileges = {
      LVAdmin = [
        {
          privilege = "LiveViewAll"
        }
      ]
      LVInternal = [
        {
          privilege = "APIConnect"
        }
        {
          privilege = "LiveViewShutdown"
        }
      ...
      ]
      LVUser = [
        {
          privilege = "APIConnect"
        }
        {
          privilege = "LiveViewTableList"
        }
        {
          privilege = "LiveViewTableManage"
        }
        {
          privilege = "LiveViewTableAll"
          resource = "ItemsSales"
        }
        ...
        {
          privilege = "LiveViewTupleInfo"
          resource = "ItemsSales.DataIn"
        }
        {
          privilege = "LiveViewTupleSend"
          resource = "ItemsSales.DataIn"
        }
      ]
      LVGuest = [
        {
          privilege = "APIConnect"
        }
        {
          privilege = "LiveViewTableList"
        }
      ...
      ]
    }
  }
}

The privilege group names LVAdmin, LVUser, and LVGuest are only examples and are not required. You can use any set of group names with any granularity of privilege groupings required by your site. It is a best practice continuing to use LVInternal as the group to contain privilege settings for the internal LiveView user name.

name = "role-priv-mappings"
version = "1.0.0"
type = "com.tibco.ep.dtm.configuration.security"

configuration = {
  RoleToPrivilegeMappings = {
    privileges = {
      LVUserRLS = [
        {
          privilege = " ... "
          resource = " ... "
        }
          privilege = "LiveViewRowLevelAccess"
            resource = 
              """
                [{ table = "ItemsSales"
                   predicate = ["category=='toy'"]
                }]
              """
      ]
    }
  }
}

Several internal LiveView components are required to make requests to access LiveView server resources. When authentication is enabled, these internal requests must be made in the context of a valid LiveView user name configured with the appropriate permissions. A special role, LVInternal, is available to satisfy this requirement.

To designate a user name as the internal user with the LVInternal role, use a configuration file with HOCON type ldminternalcredentials.

name = "ldm-internal-user-credentials"
version = "1.0.0"
type = "com.tibco.ep.ldm.configuration.ldminternalcredentials"

configuration = {
  InternalCredentials = {
    ldmInternalUserName = "lvintern"
    ldmInternalPassword = "secret1"
  }
}

See Enciphered Passwords above for the supported way to encipher the internal user's password for added security.

A configuration file of HOCON type ldmclientapilistener defines the authentication realm associated with this listener, indicating that user authentication is to be performed for requests handled by this listener. This file also configures the TCP port for the LiveView client API to listen on.

name = "clientApiListener"
version = "1.0.0"
type = "com.tibco.ep.ldm.configuration.ldmclientapilistener"
configuration = {
  ClientAPIListener = {
    portNumber = 10443    
    authenticationRealmName = "authRealm"
    secureCommunicationProfileName = "my-secure-communication-client-profile"
  }
}

Although not strictly required, you can use a configuration file of HOCON type ldmengine to specify the JVM argument settings that is recommended as a minimum for LiveView projects.

name= "engineforsecurity"
version= "1.0.0"
type= "com.tibco.ep.ldm.configuration.ldmengine"
configuration = {
  LDMEngine = {
    systemProperties = {
      "liveview.ssl.hostname" = "localhost"   
     }
      jvmArgs = [
      "-Xmx1024m"
      "-Xms512m"
      "-XX:MaxPermSize=768m"
     ]
  }
}