Configuring SSL for TM1 Web with LDAP authentication

Summary

In some cases you might want to configure SSL communication for TM1 Web, as well as LDAP authentication for user login. Both of these processes make changes to some of the same configuration files, so you must take care to follow the order of instructions so that no errors arise.

The first recommendation is to follow the SSL setup for TM1 Web starting from a fresh installation. This process can be done with the following process that uses your existing certificates:

https://www.ibm.com/docs/en/planning-analytics/2.0.0?topic=itw-configure-ssl-planning-analytics-tm1-webspreadsheet-services-existing-keystore

In case there are no existing certificates, you can follow these steps instead to assist with generating the appropriate certificate requests:

https://www.ibm.com/support/pages/how-configure-ssl-planning-analytics-web-tier-using-gskit-new-certificate-signing-request

Once TM1 Web is working as expected with the HTTPS URL, you can move on to setting up the LDAP authentication. Once this is completed, the following instructions allow SSL communication for the authentication process:

https://www.ibm.com/support/pages/how-configure-tm1web-application-server-allow-ssl-ldap-when-using-kerberos-authentication

In case any errors arise after following each of these processes, the best place to start is looking at the server.xml file. This file is modified in both of the above processes, so care must be taken that no necessary pieces were overwritten from either of them. Beyond that, further troubleshooting can be done using the tm1 messages log file from the TM1 Web install directory.