# Installation, identity stores, SSO and SSL

*Tableau Server Administrator Study Guide · Install & Configure · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-server-administrator/install-and-configure/installation-identity-stores-sso-and-ssl*

How a Windows Tableau Server 2022.3 install is laid out and configured: install and data paths, the gateway port, the permanent choice between a local and an Active Directory identity store, the SSO options each store allows (trusted tickets, SAML, Kerberos, OpenID Connect, SSPI automatic logon), external SSL, the single-machine baseline and silent installs.

- Certification: Salesforce Tableau Server Administrator
- Exam section: Install & Configure
- Study guide: https://www.certifyforce.com/study-guide/tableau-server-administrator

**Official exam objective:**

> 2.1 Installation: 2.1.1 Understand installation steps and options: 2.1.1.1 Install Path, 2.1.1.2 Gateway port; 2.1.2 Understand Identity Store and SSO options: 2.1.2.1 External (Active Directory) vs. local, 2.1.2.2 Trusted Tickets, 2.1.2.3 SAML, 2.1.2.4 Kerberos and OpenID Connect; 2.1.3 Describe the impact of the automatic-login options; 2.1.4 Understand how to set up SSL; 2.1.5 Understand Tableau best practices for installing a single-machine environment; 2.1.6 Understand silent installs.

## What the exam expects

- Predict where the program files and the data directory land for a default or custom install path, and change the gateway HTTP port after installation.
- Choose between a local and an external (Active Directory) identity store before the initial configuration is applied.
- Match a sign-in requirement to trusted tickets, server-wide or site-specific SAML, Kerberos, OpenID Connect or automatic logon (SSPI), and know which combinations are blocked.
- Describe the external SSL setup and the files it needs.
- Apply the single-machine baseline and the rules for silent and automated installs.

Key terms: **identity store** (where Tableau Server's users and groups are managed: local or external); **gateway** (the Apache process that receives every client request); **trusted ticket** (a short-lived string a trusted web server requests for a user); **SSPI automatic logon** (Windows sign-in reused for Tableau on an Active Directory server); **external SSL** (encryption of HTTP traffic between clients and the gateway).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Non-default install location | The data directory installs into the same path | [Before you install...](https://help.tableau.com/current/server/en-us/requ.htm) |
| Gateway ports | 80 for HTTP (changeable), 443 for SSL (not changeable) | [Tableau Server Gateway Process](https://help.tableau.com/current/server/en-us/server_process_gateway.htm) |
| Identity store | Cannot be changed after it is configured and applied | [Configure Initial Node Settings](https://help.tableau.com/current/server/en-us/config_general.htm) |
| Trusted ticket lifetime | Must be redeemed within three minutes; views only | [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm) |
| `target_site` | The case-sensitive Site ID, required for a non-Default site | [Get a Ticket from Tableau Server](https://help.tableau.com/current/server/en-us/trusted_auth_webrequ.htm) |
| Site-specific SAML | Local identity store only; server-wide SAML configured first | [Configure Site-Specific SAML](https://help.tableau.com/current/server/en-us/saml_site_specific.htm) |
| OIDC set up in TSM | Requires a local identity store | [Requirements for Using OpenID Connect](https://help.tableau.com/current/server/en-us/openid_auth_requirements.htm) |
| SSPI | Windows and Active Directory only; not with SAML, trusted authentication, a load balancer or a proxy | [Authentication](https://help.tableau.com/current/server/en-us/security_auth.htm) |
| SSL files | PEM-encoded X509 `.crt` plus its RSA or DSA private key | [Configure External SSL](https://help.tableau.com/current/server/en-us/ssl_config.htm) |
| Silent Setup | Server does not start; run `tsm start` | [Install Switches and Properties](https://help.tableau.com/current/server/en-us/silent_installer_flags.htm) |
| Single machine | Initial, limited, non-critical use; HA needs three nodes | [Recommended Baseline Configurations](https://help.tableau.com/current/server/en-us/server_baseline_config.htm) |

## Check yourself

- Why can't someone who reads the repository reuse stored trusted tickets?
- Why does Tableau recommend sending trusted tickets only over SSL/TLS?
- When does Tableau Server answer a ticket request with -1?
- What license does `SilentInstaller.py` activate when no product key is supplied?

## Sources

- [Before you install...](https://help.tableau.com/current/server/en-us/requ.htm)
- [Install TSM](https://help.tableau.com/current/server/en-us/setup.htm)
- [Configure Initial Node Settings](https://help.tableau.com/current/server/en-us/config_general.htm)
- [Tableau Server Gateway Process](https://help.tableau.com/current/server/en-us/server_process_gateway.htm)
- [tsm topology](https://help.tableau.com/current/server/en-us/cli_topology_tsm.htm)
- [Identity Store](https://help.tableau.com/current/server/en-us/plan_identity_store.htm)
- [Authentication](https://help.tableau.com/current/server/en-us/security_auth.htm)
- [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm)
- [Get a Ticket from Tableau Server](https://help.tableau.com/current/server/en-us/trusted_auth_webrequ.htm)
- [SAML](https://help.tableau.com/current/server/en-us/saml.htm)
- [Configure Site-Specific SAML](https://help.tableau.com/current/server/en-us/saml_site_specific.htm)
- [Kerberos Requirements](https://help.tableau.com/current/server/en-us/kerberos_requ.htm)
- [Requirements for Using OpenID Connect](https://help.tableau.com/current/server/en-us/openid_auth_requirements.htm)
- [Provision and Authenticate Users Using Identity Pools](https://help.tableau.com/current/server/en-us/identity_pools.htm)
- [Configure SSL for External HTTP Traffic to and from Tableau Server](https://help.tableau.com/current/server/en-us/ssl_config.htm)
- [Recommended Baseline Configurations](https://help.tableau.com/current/server/en-us/server_baseline_config.htm)
- [Install Switches and Properties for Tableau Server](https://help.tableau.com/current/server/en-us/silent_installer_flags.htm)
- [Automated Installation of Tableau Server](https://help.tableau.com/current/server/en-us/automated_install_windows.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 15 linked practice questions, and unlimited timed mock exams are included with the Tableau Server Administrator pack (USD $19): https://www.certifyforce.com/practice-exams