SAML
SAML (Security Assertion Markup Language) is an XML standard that allows secure web domains to exchange user authentication and authorization data. You can configure Tableau Server to use an external identity provider (IdP) to authenticate users over SAML 2.0. No user credentials are stored with Tableau Server, and using SAML enables you to add Tableau to your organization’s single sign-on environment.
You can use SAML server wide, or you can configure sites individually. Here’s an overview of those options:
-
Server-wide SAML authentication. A single SAML IdP application handles authentication for all Tableau Server users. Use this option if your server has only the Default site, as it is unnecessary to configure site specific SAML in this case. You may also use Server-wide SAML in multisite environments, but users are limited to a single IdP to across all sites.
-
Server-wide local authentication and site-specific SAML authentication. In a multi-site environment, users who are not enabled for SAML authentication at the site level can sign in using local authentication.
-
Server-wide SAML authentication and site-specific SAML authentication. In a multi-site environment, all users authenticate through a SAML IdP configured at the site level, and you specify a server-wide default SAML IdP for users that belong to multiple sites.
If you want to use site-specific SAML, you must configure server-wide SAML before you configure individual sites. Server-side SAML does not need to be enabled for site-specific SAML to function, but it must be configured.
User authentication through SAML does not apply to permissions and authorization for Tableau Server content, such as data sources and workbooks. It also does not control access to underlying data that workbooks and data sources connect to.
Notes:
- Tableau Server supports both service provider initiated and IdP initiated SAML in browsers and in the Tableau Mobile app. SAML connections from Tableau Desktop must be service provider initiated.
- Identity pools, which is a tool designed to complement and support additional user provisioning and authentication options you might need in your organization, supports OpenID Connect (OIDC) authentication only. For more information, see Provision and Authenticate Users Using Identity Pools.
Authentication overview
The following image shows the steps to authenticate a user with single sign-on in a typical service provider initiated flow:
-
User navigates to the Tableau Server sign-in page or clicks a published workbook URL.
-
Tableau Server starts the authentication process by redirecting the client to the configured IdP.
-
The IdP requests the user’s username and password from the user. After the user submits valid credentials, the IdP authenticates the user.
-
The IdP returns the successful authentication in the form of a SAML Response to the client. The client passes the SAML Response to Tableau Server.
-
Tableau Server verifies that the username in the SAML Response matches a licensed user stored in the