Known Issue: User Access Denied to Spotfire Dashboard with error message "You must accept the request for permissions to log in to Spotfire" in the browser
Article ID: KB0138495
Updated On:
| Products | Versions |
|---|---|
| Spotfire | All |
Description
When a user tries to access the Spotfire dashboard on the browser, the user gets an error message, "You must accept the request for permissions to log in to Spotfire."
Log entries confirm this issue:
- access.log shows:
- "GET /spotfire/auth/oidc/authenticate?state=h1ep27uk3ks5e79ur0c7tur1aq&error=access_denied&error_description=User+is+not+assigned+to+the+client+application. HTTP/1.1" 302 -
- server.log shows:
- auth.oidc.OAuth2ClientManager: An error response was returned from the authorization endpoint (access_denied), error_description: User is not assigned to the client application.
- auth.oidc.OidcAuthenticator: OpenID Connect authentication failed com.spotfire.server.security.auth.oidc.AuthorizationEndpointOAuth2ClientException: An error response was returned from the authorization endpoint
This indicates that while Spotfire attempts authentication via OpenID Connect, the IdP denies access because the user lacks the required role or assignment to the Spotfire application. Common reasons for this include changes in group membership or automated clean-up policies that unassign inactive users from applications.
Resolution
- To resolve this issue, ensure the user is correctly assigned to the Spotfire application within your Identity Provider (IdP).
- Verify that the user is explicitly added to the Spotfire Application Group within your Identity Provider (e.g., Okta or Azure Intra ID portal). This assignment must be done in the IdP, not solely within the Spotfire User Manager.
- After confirming the IdP assignment, ask the user to attempt logging in via an Incognito or Private browser window.
- If logging in via an Incognito/Private window is successful, instruct the user to clear their browser cache and cookies in their regular browser before attempting to log in again.
Issue/Introduction
Users may encounter an "access denied" error when attempting to access Spotfire dashboards if they are not assigned to the Spotfire application group within the configured Identity Provider (IdP), such as Okta, Azure Intra ID, etc. This issue is resolved by ensuring the user has the necessary role assignment in the IdP.
Additional Information
Doc: Configuring OpenID Connect.
KBA: KB0075873 How to configure OpenID Connect authentication with Okta on the TIBCO Spotfire Server.
KBA: KB0079218 How to configure OpenID Connect authentication with Google on the TIBCO Spotfire Server.
KBA: KB0075046 How to configure OpenID Connect authentication with Azure on the TIBCO Spotfire Server.
