Troubleshooting12% of the exam
Third-party cookies and embedded sessions
Why Tableau Server sign-in depends on a browser session cookie, when that cookie counts as first-party or third-party, what a redeemed trusted ticket leaves behind, and how to locate an embedded sign-in failure before changing settings.
4.1 Understand requirements of third-party cookies in a browser
~8 min read · 2 practice questions
What the exam expects
- Explain how Tableau Server keeps a signed-in browser user authenticated, and what happens when the browser refuses to store that cookie.
- Classify the Tableau session cookie as first-party or third-party from the domain in the browser's address bar.
- State the third-party cookie requirement for embedded views, trusted authentication and connected apps.
- Describe the sign-in state a browser is in after Tableau Server redeems a trusted ticket.
- Tell a ticket-issuance failure apart from a browser cookie failure when an embedded sign-in breaks.
Key terms:
- Session cookie: the cookie stored in the browser at sign-in that tells Tableau Server the user is already authenticated.
- First-party cookie: a cookie set for the same domain or sub-domain as the browser's address bar.
- Third-party cookie: a cookie set for a domain different from the one in the address bar, as happens inside an embedded view.
- Trusted ticket: a short-lived string a trusted web server obtains from Tableau Server so a portal user skips a second sign-in.
- Connected app: a trust relationship (direct trust or OAuth 2.0 trust) that authenticates embedded users with a JSON Web Token.
Key facts
What keeps a user signed in
- Detail
- A session cookie stored in the local browser at sign-in
Browser blocks first-party cookies
- Detail
- The user cannot sign in to Tableau Server
Embedded or trusted sign-in
- Detail
- Cookie domain differs from the address bar, so it is third-party
Ticket redemption
- Detail
- Creates a session, logs the user in, removes the ticket from the URL
wgserver.unrestricted_ticket- Detail
- Default
false: trusted-ticket users reach views only
Connected apps
- Detail
- Introduced in 2021.4; browsers must still allow third-party cookies
wgserver.saml.iframed_idp.enabled- Detail
- Default
false: embedded SAML sign-in opens in a pop-up
Idle timeout
- Detail
wgserver.session.idle_limit, default 240 minutes
Ticket value
-1- Detail
- Server could not issue the ticket; reason in the vizqlserver logs
Sources for this section (5)
- Cookie Restriction Errorhelp.tableau.com (opens in a new tab)
- Trusted Authenticationhelp.tableau.com (opens in a new tab)
- tsm configuration set Optionshelp.tableau.com (opens in a new tab)
- Authentication and Embeddinghelp.tableau.com (opens in a new tab)
- Ticket Value of -1help.tableau.com (opens in a new tab)
- Why can a second person at a shared browser still reach an embedded view after the first person leaves the host application?
- By default, where does a SAML user's identity-provider sign-in form open after they select the sign-in button on an embedded view?
- When you need more trusted-authentication detail in the logs, which key do you change and what must follow?
- Which Tableau release introduced connected apps for embedded content, and what do they use to authenticate users?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Server Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 34 lessons of the Tableau Server Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (2 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both