In a hybrid setup with multiple legacy data sources on-prem and new data sources in the cloud, Spotfire should be able to request and "impersonate" the user with Kerberos.
So the frontend supports OpenID Connect for authentication and the backend supports OpenID Connect plus Kerberos Delegation.