Enable SAML Authentication on a Site

Enable SAML Authentication on a Site or TCM

This topic explains how to enable SAML on the site or Tableau Cloud Manager (TCM) and select single sign-on (SSO) users. It also provides steps for switching from SAML to the default Tableau authentication. Before you enable SAML, we recommend that you review the SAML Requirements for Tableau Cloud, including Effects of changing authentication type on Tableau Bridge.

This topic assumes you are familiar with the information in Authentication and How SAML Authentication Works.

IdP-specific configuration information

The steps in the sections later in this topic provide basic steps that you can use with your IdP’s documentation to configure SAML for your Tableau Cloud site or TCM. You can get IdP-specific configuration steps for the following IdPs:

Enable SAML

For Tableau Cloud

Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication.
On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down and then enter a name for the configuration.
Note: Configurations created before November 2024 (Tableau 2024.3) can't be renamed.

For TCM

Alternatively, in TCM, do the following:

Sign in to TCM as a cloud administrator, and select Settings > Authentication.
Select the Enable an additional authentication method tick box, and select SAML from the Authentication drop-down.
Click the Configuration (required) drop-down arrow.

SAML configuration steps

This section takes you through the configuration steps that appear on the Authentication tab in the Tableau Cloud or TCM Settings page.

Note: To complete this process, you will also need the documentation your IDP provides. Look for topics that refer to configuring or defining a service provider for a SAML connection, or adding an application.

Step 1: Export metadata from IdP

Go to your IdP, sign in to your IdP account and use the instructions provided by the IdP’s documentation to download your IdP's metadata. The IdP's metadata enables Tableau Cloud or TCM to connect to your IdP.

For step 1, the IdP’s documentation will also guide you in how to provide metadata to a service provider. It will instruct you to download a SAML metadata file, or it will display XML code. If it displays XML code, copy and paste the code into a new text file, and save the file with a .xml extension.

Step 2: Upload metadata to Tableau

For Tableau Cloud, in the New Configuration page in Tableau Cloud, import the metadata (.xml) file that you downloaded from the IdP or configured manually from the XML it provided.

For TCM, in the Authentication page in TCM, import the metadata (.xml) file that you downloaded from the IdP or configured manually from the XML it provided.

Notes:

After uploading the IdP metadata, both the IdP entity ID and IdP SSO service URL fields populate automatically.
If editing the configuration, you will need to upload the metadata file so Tableau knows to use the correct IdP entity ID and SSO service URL.
You can use the Clear IdP Metadata button if you need to upload a new metadata file.

Step 3: Map attributes

Attributes contain authentication, authorisation and other information about a user.

Note: Tableau Cloud or TCM requires the NameID attribute in the SAML response. You can provide other attributes to map usernames in Tableau, but the response message must include the NameID attribute.

Username: (Required) Enter the name of the attribute that stores users’ usernames (email addresses).
Email address: (Optional) Enter the name of the attribute that contains the email address that the IdP uses during the authentication process to enable users to receive notifications at an email address that is different from the username. The email address attribute is used for notifications purposes only and not used for sign-in.
Display name: (Optional but recommended) Some IDPs use separate attributes for first and last names, and others store the full name in one attribute.
Select the button that corresponds to the way your IdP stores the names. For example, if the IdP combines first and last name in one attribute, select Display name, and then enter the attribute name.

Step 4: Choose default for embedded views

Note: Applies to Tableau Cloud only.

Select the method by which users sign in to embedded views. The options are to open a separate pop-up window that displays the IdP’s sign-in form, or to use an inline frame (iframe).

Important: Because iframes can be vulnerable to clickjacking attacks, not all IDPs support signing in through an iframe. With clickjacking, the attacker tries to lure users into clicking or entering content. They do this by displaying the page to attack in a transparent layer over an unrelated page. For Tableau Cloud, an attacker might try to capture user credentials or to get an authenticated user to change settings. For more information, see Clickjacking(Link opens in a new window) on the Open Web Application Security Project website.

If your IdP doesn’t support signing in through an iframe, select Authenticate in a separate pop-up window.

Step 4: Get Tableau metadata (TCM)

To create the SAML connection between TCM and your IdP, you need to exchange required metadata between the two services. To get metadata from TCM, choose one of the following methods. See the IdP’s SAML configuration documentation to confirm the correct option.

Select the Export Metadata button to download an XML file that contains the Tableau Cloud SAML entity ID, Assertion Consumer Service (ACS) URL and X.509 certificate.
Select Download Certificate if your IdP expects the required information in a different way. For example, if it wants you to enter the Tableau Cloud entity ID, ACS URL and X.509 certificate in separate locations.

Step 5: Get Tableau metadata (Tableau Cloud)

To create the SAML connection between Tableau Cloud and your IdP, you need to exchange required metadata between the two services. To get metadata from Tableau Cloud, choose one of the following methods. See the IdP’s SAML configuration documentation to confirm the correct option.

Select the Export Metadata button to download an XML file that contains the Tableau Cloud SAML entity ID, Assertion Consumer Service (ACS) URL and X.509 certificate.
Select Download Certificate if your IdP expects the required information in a different way. For example, if it wants you to enter the Tableau Cloud entity ID, ACS URL and X.509 certificate in separate locations.

Step 5: Configure IdP (TCM)

For step 5, use the instructions provided by the IdP’s documentation to submit the TCM metadata.

Step 6: Configure IdP (Tableau Cloud)

For step 6, use the instructions provided by the IdP’s documentation to submit the Tableau Cloud metadata.

Step 6: Test configuration and troubleshoot SAML (TCM)

We highly recommend that you test the SAML configuration to avoid any locked-out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured.

If you can't successfully sign in to TCM, start with the troubleshooting steps suggested on the Authentication page. If those steps do not resolve the issue, see Troubleshoot SAML.

Step 7: Test configuration and troubleshoot SAML (Tableau Cloud)

If you can't successfully sign in to Tableau Cloud, start with the troubleshooting steps suggested on the New Configuration page. If those steps do not resolve the issue, see Troubleshoot SAML.

Manage users

Select existing Tableau Cloud or TCM users, or add new users you want to approve for single sign-on.

When you add or import users, you also specify their authentication type. On the Users page, you can change users’ authentication type any time after adding them.

For more information, see one of the following:

Add Users to a Site or Import Users topic for Tableau Cloud
Manage Users With Tableau Cloud Manager topic for TCM

Default authentication type for embedded views

Note: Applies to Tableau Cloud only.

Let users choose their authentication type
When this option is selected, only a pop-up window will be supported. In this pop-up window, two sign-in options appear where a view is embedded: a sign-in button that uses single sign-on (SSO) authentication and a link to use Tableau credentials as the alternative.
Tip: With this option, users need to know which sign-in option to choose. As part of notification you send your users after you add them to the single sign-on site, let them know which type of authentication to use for a variety of sign-in scenarios. For example, embedded views, Tableau Desktop, Tableau Bridge, Tableau Mobile, and so on.
Tableau with MFA
This option requires users to sign in using Tableau credentials with multi-factor authentication even if SAML is enabled on the site. Signing in with Tableau with MFA requires users to set a verification method to confirm the identity each time the user signs in to Tableau Cloud. For more information, see Multi-Factor Authentication and Tableau Cloud.
List of authentication configurations
When a specific configuration option is selected, the way users can sign in to embedded views is determined by the setting you configured in step 6 above for the named configuration.

Use Tableau authentication

If a site or tenant is configured for SAML, you can change the settings to require some or all users to sign in using Tableau credentials.

If you no longer want an identity provider to handle authentication , or require all users to sign in with their Tableau credentials, you can change the authentication type at the site or tenant level. See Change the site’s authentication type section, below.
If you want to keep SAML enabled for some users, but require others to use Tableau, you can change authentication type at the user level. For more information, see Set the User Authentication Type.

Change the site’s authentication type

For Tableau Cloud

Beginning in November 2024 (Tableau 2024.3), you can enable multiple authentication types and methods on a site. To change what authentication you want available on the site, enable or disable the authentication configurations.

Sign in to the Tableau Cloud site as a site administrator.
Select Settings > Authentication.
Disable or enable authentication configurations for the site by clicking the Actions menu and selecting Disable or Enable.

After you make the SAML configuration inactive, the metadata and IdP information are preserved so that if you want to enable it again, you do not need to set up the SAML connection with the IdP again.

For TCM

Sign in to the TCM as a cloud administrator.
Select Settings > Authentication.
Remove the selection from the Enable an additional authentication method tick box.

Update SAML certificate

The certificate used for Tableau site metadata is provided by Tableau and not configurable. To update the certificate for SAML, you must upload a new certificate to your IdP and re-exchange the metadata with Tableau Cloud.

For Tableau Cloud

Sign in to the site as a site administrator and select Settings > Authentication.
Under Authentication types, go to the SAML configuration you want to update and click the Actions menu and select Edit.
Open a new tab or window, and sign in to your IdP account.
Use the instructions provided by the IdP’s documentation to upload a new SAML certificate.
Download the new XML metadata file to provide to Tableau Cloud.
Return to the Edit Configuration page in Tableau Cloud, and in step 2, upload the metadata file that you downloaded from the IdP.
Scroll down the page and click the Save and Continue button.

For TCM

Sign in to the TCM as a cloud administrator, and select Settings > Authentication.
From the Authentication drop-down, select SAML > Configuration (required).
Open a new tab or window, and sign in to your IdP account.
Use the instructions provided by the IdP’s documentation to upload a new SAML certificate.
Download the new XML metadata file to provide to TCM.
Return to the Authentication page in TCM, and in step 2, upload the metadata file that you downloaded from the IdP.
Scroll down the page and click the Save and Continue button.

Tableau Cloud Help