# Mutual SSL, trusted tickets, connected apps and LDAP

*Tableau Architect Study Guide · Deploy Tableau Server · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-architect/deploy-tableau-server/mutual-ssl-trusted-tickets-connected-apps-and-ldap*

Configure and troubleshoot the certificate, ticket, token and directory mechanisms of Tableau Server: mutual SSL, trusted authentication, direct-trust and OAuth 2.0 trust connected apps, and an LDAP identity store with an encrypted channel.

- Certification: Salesforce Tableau Architect
- Exam section: Deploy Tableau Server
- Study guide: https://www.certifyforce.com/study-guide/tableau-architect

**Official exam objective:**

> 2.2 Configure and troubleshoot supported authentication methods: 2.2.1 Configure and troubleshoot SAML; 2.2.2 Configure and troubleshoot Kerberos; 2.2.3 Configure and troubleshoot OpenID Connect; 2.2.4 Configure and troubleshoot Mutual SSL; 2.2.5 Configure and troubleshoot trusted authentication; 2.2.6 Configure and troubleshoot Connected App authentication; 2.2.7 Configure and troubleshoot LDAP; 2.2.8 Configure and troubleshoot Azure Active Directory; 2.2.9 Identify dependencies between authentication methods and Tableau environments, including Tableau Cloud.

## What the exam expects

- Configure mutual SSL on top of external SSL, choose the certificate username mapping and predict fallback behavior for browsers and REST clients.
- Configure trusted authentication: trusted hosts, the ticket request, client IP matching and its network requirements.
- Configure direct-trust and OAuth 2.0 trust connected apps, including embedded authoring, project scope and site-level external authorization servers.
- Configure an LDAP identity store at setup, encrypt its simple bind and change its settings after initialization.
- SAML, Kerberos, OpenID Connect, Microsoft Entra ID (formerly Azure Active Directory) and the Server-versus-Cloud method dependencies are taught in SAML, Kerberos, OpenID Connect and Entra ID sign-in.

Key terms: **mutual SSL** (client and server both present certificates, and the server signs the user in from the client certificate); **trusted ticket** (one-time string Tableau Server issues to a trusted web server for a user); **connected app** (site-level trust between Tableau and an external application, verified with a JSON Web Token, JWT); **EAS** (external authorization server, usually an IdP, used by OAuth 2.0 trust); **simple bind** (LDAP session opened with a username and password).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Mutual SSL prerequisite | External SSL configured first | [Mutual SSL](https://help.tableau.com/current/server/en-us/ssl_config_mutual.htm) |
| Username mapping | Local: UPN; AD: LDAP lookup; `-m cn` uses common name | [Mutual SSL](https://help.tableau.com/current/server/en-us/ssl_config_mutual.htm) |
| Fallback disabled | Browsers need a certificate; REST username and password still accepted | [Mutual SSL](https://help.tableau.com/current/server/en-us/ssl_config_mutual.htm) |
| Ticket lifetime | Redeem within three minutes; failure returns -1 | [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm) |
| `-th` | Replaces the full trusted-host list | [Trusted hosts](https://help.tableau.com/current/server/en-us/trusted_auth_trustIP.htm) |
| `client_ip` | Browser computer's address, with extended checking enabled | [Get a ticket](https://help.tableau.com/current/server/en-us/trusted_auth_webrequ.htm) |
| Address family | Trusted authentication supports IPv4 only | [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm) |
| Embedded authoring | `tableau:views:embed_authoring` in `scp`, existing permissions apply | [Direct trust](https://help.tableau.com/current/server/en-us/connected_apps_direct.htm) |
| Multiple projects | REST API only, from 2024.2 | [Direct trust](https://help.tableau.com/current/server/en-us/connected_apps_direct.htm) |
| Site-level EAS | From 2024.2; connected apps enabled in TSM first | [OAuth 2.0 trust](https://help.tableau.com/current/server/en-us/connected_apps_eas.htm) |
| LDAP bind username | Distinguished name with query permission | [LDAP reference](https://help.tableau.com/current/server-linux/en-us/ldap_config.htm) |
| LDAP certificate in a cluster | Copied manually to each Application Server node | [Encrypted LDAP](https://help.tableau.com/current/server/en-us/config_encrypt_ldap.htm) |

## Check yourself

- Why does Tableau recommend deploying trusted tickets only over SSL/TLS or another encrypted layer?
- When the external application's clock is not set to UTC, what happens to its connected-app tokens?
- What range of trusted ticket token lengths does Tableau Server accept, and what is the default?
- When must the encrypted channel for LDAP simple bind be configured?

## Sources

- [Configure Mutual SSL Authentication](https://help.tableau.com/current/server/en-us/ssl_config_mutual.htm)
- [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm)
- [Add Trusted IP Addresses or Host Names to Tableau Server](https://help.tableau.com/current/server/en-us/trusted_auth_trustIP.htm)
- [Get a Ticket from Tableau Server](https://help.tableau.com/current/server/en-us/trusted_auth_webrequ.htm)
- [Optional: Configure Client IP Matching](https://help.tableau.com/current/server/en-us/trusted_auth_optional.htm)
- [Use Tableau Connected Apps for Application Integration](https://help.tableau.com/current/server/en-us/connected_apps.htm)
- [Configure Connected Apps with Direct Trust](https://help.tableau.com/current/server/en-us/connected_apps_direct.htm)
- [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/current/server/en-us/connected_apps_eas.htm)
- [External Identity Store Configuration Reference](https://help.tableau.com/current/server-linux/en-us/ldap_config.htm)
- [Configure Encrypted Channel to LDAP External Identity Store](https://help.tableau.com/current/server/en-us/config_encrypt_ldap.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Tableau Architect pack (USD $19): https://www.certifyforce.com/practice-exams