Deploy Tableau Server37% of the exam
SAML, Kerberos, OpenID Connect and Entra ID sign-in
How to configure and troubleshoot server-wide and site-specific SAML, Kerberos single sign-on, OpenID Connect and the Microsoft Entra ID gallery app for Tableau Cloud, and how identity stores and Tableau Server versus Tableau Cloud limit which methods you can use.
2.2 Configure and troubleshoot supported authentication methods: 2.2.1 Configure and troubleshoot SAML; 2.2.2 Configure and troubleshoot Kerberos; 2.2.3 Configure and troubleshoot OpenID Connect; 2.2.4 Configure and troubleshoot Mutual SSL; 2.2.5 Configure and troubleshoot trusted authentication; 2.2.6 Configure and troubleshoot Connected App authentication; 2.2.7 Configure and troubleshoot LDAP; 2.2.8 Configure and troubleshoot Azure Active Directory; 2.2.9 Identify dependencies between authentication methods and Tableau environments, including Tableau Cloud.
~8 min read · 11 practice questions
What the exam expects
- Configure server-wide SAML, map assertions correctly and meet the prerequisites for site-specific SAML.
- Design Kerberos single sign-on: delegation rules, supported keytab ciphers and which browsers and mobile clients get SSO.
- Configure OpenID Connect (OIDC): ID-token requirements, user matching by claims and outbound proxy settings.
- Set up the Microsoft Entra ID (also known as Azure Active Directory) gallery app for Tableau Cloud SAML.
- Predict which methods an identity store and a deployment (Tableau Server or Tableau Cloud) allow. Mutual SSL, trusted authentication, connected apps and LDAP are taught in Mutual SSL, trusted tickets, connected apps and LDAP.
Key terms:
- Identity store: where Tableau Server manages user accounts, either local or LDAP (including Active Directory); the choice is made at setup.
- Assertion mapping: telling Tableau which SAML attribute name carries the username.
- Keytab: a file holding the Kerberos service principal's keys that Tableau Server uses to accept tickets.
subclaim: the OIDC subject identifier Tableau stores for a user after the first sign-in.- IdP-initiated SSO: sign-in that starts from the identity provider's app tile rather than from Tableau.
Key facts
Default SAML username assertion
- Detail
usernameinwgserver.saml.idpattribute.username
Site SAML identity store
- Detail
- Local only
Site entity ID and ACS URL
- Detail
- Generated from server-wide settings; cannot be modified
Keytab ciphers
- Detail
- AES-128 or AES-256; RC4 and 3DES unsupported
Constrained delegation
- Detail
- Data sources only, not SSO into Tableau
Kerberos on Tableau Mobile
- Detail
- iOS with a configuration profile; not Android
OIDC ID token
- Detail
- Must carry
kid, even with a single JWK
OIDC after first sign-in
- Detail
- User identified by the stored
sub
OIDC through a Windows system proxy
- Detail
tomcat.useSystemProxiesset totrue
Entra Sign On URL
- Detail
- Empty for IdP-initiated SSO
Tableau Cloud and Kerberos
- Detail
- Not supported, nor LDAP identity store
Sources for this section (10)
- Server-Wide SAMLhelp.tableau.com (opens in a new tab)
- Site-Specific SAMLhelp.tableau.com (opens in a new tab)
- Kerberos Requirementshelp.tableau.com (opens in a new tab)
- Configure Kerberoshelp.tableau.com (opens in a new tab)
- Client Support for Kerberos SSOhelp.tableau.com (opens in a new tab)
- OpenID Connecthelp.tableau.com (opens in a new tab)
- OIDC Requirementshelp.tableau.com (opens in a new tab)
- Configure Server for OIDChelp.tableau.com (opens in a new tab)
- SAML with Microsoft Entra IDhelp.tableau.com (opens in a new tab)
- Migration Technical Considerationshelp.tableau.com (opens in a new tab)
- Which OIDC flow does Tableau Server support?
- Why does the default OIDC configuration need email-address usernames on Tableau Server?
- Why does Tableau Cloud recommend a dedicated site administrator on Tableau with MFA?
- When should the IdP metadata uploaded from Entra ID exclude its SLO endpoint?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 18 lessons of the Tableau Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both