# SAML, Kerberos, OpenID Connect and Entra ID sign-in

*Tableau Architect Study Guide · Deploy Tableau Server · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-architect/deploy-tableau-server/saml-kerberos-openid-connect-and-entra-id-sign-in*

How to configure and troubleshoot server-wide and site-specific SAML, Kerberos single sign-on, OpenID Connect and the Microsoft Entra ID gallery app for Tableau Cloud, and how identity stores and Tableau Server versus Tableau Cloud limit which methods you can use.

- Certification: Salesforce Tableau Architect
- Exam section: Deploy Tableau Server
- Study guide: https://www.certifyforce.com/study-guide/tableau-architect

**Official exam objective:**

> 2.2 Configure and troubleshoot supported authentication methods: 2.2.1 Configure and troubleshoot SAML; 2.2.2 Configure and troubleshoot Kerberos; 2.2.3 Configure and troubleshoot OpenID Connect; 2.2.4 Configure and troubleshoot Mutual SSL; 2.2.5 Configure and troubleshoot trusted authentication; 2.2.6 Configure and troubleshoot Connected App authentication; 2.2.7 Configure and troubleshoot LDAP; 2.2.8 Configure and troubleshoot Azure Active Directory; 2.2.9 Identify dependencies between authentication methods and Tableau environments, including Tableau Cloud.

## What the exam expects

- Configure server-wide SAML, map assertions correctly and meet the prerequisites for site-specific SAML.
- Design Kerberos single sign-on: delegation rules, supported keytab ciphers and which browsers and mobile clients get SSO.
- Configure OpenID Connect (OIDC): ID-token requirements, user matching by claims and outbound proxy settings.
- Set up the Microsoft Entra ID (also known as Azure Active Directory) gallery app for Tableau Cloud SAML.
- Predict which methods an identity store and a deployment (Tableau Server or Tableau Cloud) allow. Mutual SSL, trusted authentication, connected apps and LDAP are taught in Mutual SSL, trusted tickets, connected apps and LDAP.

Key terms:
- **Identity store:** where Tableau Server manages user accounts, either local or LDAP (including Active Directory); the choice is made at setup.
- **Assertion mapping:** telling Tableau which SAML attribute name carries the username.
- **Keytab:** a file holding the Kerberos service principal's keys that Tableau Server uses to accept tickets.
- **`sub` claim:** the OIDC subject identifier Tableau stores for a user after the first sign-in.
- **IdP-initiated SSO:** sign-in that starts from the identity provider's app tile rather than from Tableau.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default SAML username assertion | `username` in `wgserver.saml.idpattribute.username` | [Server-Wide SAML](https://help.tableau.com/current/server/en-us/config_saml.htm) |
| Site SAML identity store | Local only | [Site-Specific SAML](https://help.tableau.com/current/server/en-us/saml_site_specific.htm) |
| Site entity ID and ACS URL | Generated from server-wide settings; cannot be modified | [Site-Specific SAML](https://help.tableau.com/current/server/en-us/saml_site_specific.htm) |
| Keytab ciphers | AES-128 or AES-256; RC4 and 3DES unsupported | [Kerberos Requirements](https://help.tableau.com/current/server/en-us/kerberos_requ.htm) |
| Constrained delegation | Data sources only, not SSO into Tableau | [Configure Kerberos](https://help.tableau.com/current/server/en-us/config_kerberos.htm) |
| Kerberos on Tableau Mobile | iOS with a configuration profile; not Android | [Client Support for Kerberos SSO](https://help.tableau.com/current/server/en-us/kerberos_browser.htm) |
| OIDC ID token | Must carry `kid`, even with a single JWK | [OpenID Connect](https://help.tableau.com/current/server/en-us/openid_auth.htm) |
| OIDC after first sign-in | User identified by the stored `sub` | [OIDC Requirements](https://help.tableau.com/current/server/en-us/openid_auth_requirements.htm) |
| OIDC through a Windows system proxy | `tomcat.useSystemProxies` set to `true` | [Configure Server for OIDC](https://help.tableau.com/current/server/en-us/openid_auth_server_config.htm) |
| Entra Sign On URL | Empty for IdP-initiated SSO | [SAML with Microsoft Entra ID](https://help.tableau.com/current/online/en-us/saml_config_azure_ad.htm) |
| Tableau Cloud and Kerberos | Not supported, nor LDAP identity store | [Migration Technical Considerations](https://help.tableau.com/current/server/en-us/migrate_server_to_cloud_overview.htm) |

## Check yourself

- Which OIDC flow does Tableau Server support?
- Why does the default OIDC configuration need email-address usernames on Tableau Server?
- Why does Tableau Cloud recommend a dedicated site administrator on Tableau with MFA?
- When should the IdP metadata uploaded from Entra ID exclude its SLO endpoint?

## Sources

- [Authentication (Tableau Server)](https://help.tableau.com/current/server/en-us/security_auth.htm)
- [Configure Server-Wide SAML](https://help.tableau.com/current/server/en-us/config_saml.htm)
- [Configure Site-Specific SAML](https://help.tableau.com/current/server/en-us/saml_site_specific.htm)
- [Configure Kerberos](https://help.tableau.com/current/server/en-us/config_kerberos.htm)
- [Kerberos Requirements](https://help.tableau.com/current/server/en-us/kerberos_requ.htm)
- [Tableau Client Support for Kerberos SSO](https://help.tableau.com/current/server/en-us/kerberos_browser.htm)
- [OpenID Connect](https://help.tableau.com/current/server/en-us/openid_auth.htm)
- [Configure Tableau Server for OpenID Connect](https://help.tableau.com/current/server/en-us/openid_auth_server_config.htm)
- [Requirements for Using OpenID Connect](https://help.tableau.com/current/server/en-us/openid_auth_requirements.htm)
- [Configure SAML with Microsoft Entra ID](https://help.tableau.com/current/online/en-us/saml_config_azure_ad.htm)
- [Authentication (Tableau Cloud)](https://help.tableau.com/current/online/en-us/security_auth.htm)
- [Tableau Server to Tableau Cloud Migration Technical Considerations](https://help.tableau.com/current/server/en-us/migrate_server_to_cloud_overview.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Tableau Architect pack (USD $19): https://www.certifyforce.com/practice-exams