OAuth Connections

Tableau Server supports OAuth for a number of different connectors. In most cases, OAuth functionality does not require additional configuration on Tableau Server.

From Tableau, when you sign in to data with a provider that uses OAuth, you are redirected to the provider’s sign-in page. After you provide your credentials and authorize Tableau to access your data, the data provider sends Tableau an access token that uniquely identifies requests from Tableau. For more information, see Overview of the OAuth process below.

Using OAuth connections provides the following benefits:

  • Security: Your database credentials are never known to or stored in Tableau Server, and the access token can be used only by Tableau.

  • Convenience: Instead of having to embed your data source ID and password in multiple places, you can use the token provided for a particular data provider for all published workbooks and data sources that access that data provider.

    In addition, for live connections to Google BigQuery data, each workbook viewer can have a unique access token that identifies the user, rather than sharing a single user name and password credential.

Overview of the OAuth process

The following steps describe a workflow in the Tableau environment that calls the OAuth process.

  1. You take an action that requires access to a cloud data source.

    For example, you open a workbook that’s published to Tableau Server.

  2. Tableau directs you to the cloud data provider’s sign-in page. The information that is sent to the data provider identifies Tableau as the requesting site.

  3. When you sign in to the data, the provider prompts you to confirm your authorization for Tableau Server to access the data.

  4. Upon your confirmation, the data provider sends an access token back to Tableau Server.

  5. Tableau Server presents your workbook and data to you.

    OAuth authentication overview

The following workflows can use the OAuth process:

  • Creating a workbook and connecting to the data source from Tableau Desktop or from Tableau Server.

  • Publishing a data source from Tableau Desktop.

  • Signing in to Tableau Server from an approved client, such as Tableau Mobile or Tableau Desktop.

Default saved credential connectors

Saved credentials refers to the functionality where Tableau Server stores user tokens for OAuth connections. This allows users to save their OAuth credentials to their user profile on Tableau Server. After they have saved the credentials, they will not be prompted with they subsequently publish, edit, or refresh when accessing the connector.

The following connectors use saved credentials by default. OAuth functionality on these connectors does not require additional configuration on Tableau Server.

These connectors are listed under Saved Credentials for Data Sources on users’ My Account Settings page on Tableau Server.

Users manage their saved credentials for each connector type.

Access tokens for data connections

You can embed credentials based on access tokens with data connections, to enable direct access after the initial authentication process. An access token is valid until a Tableau Server user deletes it, or the data provider revokes it.

It is possible to exceed the number of access tokens your data source provider allows. If that's the case, when a user creates a new token, the data provider uses length of time since last access to decide which token to invalidate to make room for the new one.

Access tokens for authentication from approved clients

By default, Tableau Server allows users to access their sites directly from approved Tableau clients, after users provide their credentials the first time they sign in. This type of authentication also uses OAuth access tokens to store the users' credentials securely.

For more information, see Disable Automatic Client Authentication

Default managed keychain connectors

Managed keychain refers to the functionality where OAuth tokens are generated for Tableau Server by the provider and shared by all users in the same site. When a user first publishes to the data source, Tableau Server prompts the user for the data source credentials. Tableau Server submits the credentials to the data source provider which returns OAuth tokens for Tableau Server to use on behalf of the user. On subsequent publishing operations, the OAuth token stored by Tableau Server for the same class and user name is used so that the user is not prompted for the OAuth credentials. Should the data source password change, then the above process is repeated and the old token is replaced by a new token on Tableau Server.

Additional OAuth configuration on Tableau Server is not required for the default managed keychain connectors:

  • Google Analytics
  • Google BigQuery
  • Google Sheets
  • Salesforce

Token limit and storage

Google has 50 token limit per user per client application (in this scenario, Tableau Server is the client application). Since the OAuth token is stored on Tableau Server and reused by the user, the user is unlikely to exceed the token limit.

All user tokens are encrypted at rest when stored on Tableau Server. See Manage Server Secrets for more information.

Removing unused keychain records

A managed keychain record contains connection attributes like dbClass, username, and OAuth secret attributes. All managed keychain records for a given site are merged, encrypted, and stored in Postgres.

Records are persisted even for workbooks and data sources that have been removed. Over time, these records can grow to large sizes which may cause issues.

We recommend purging the unused keychain records periodically as a regular maintenance task. You can view the number of records and unused records stored on each site. You can also delete unused records.

To access Managed Keychain Clean Up, sign in to the Tableau Server admin pages, navigate to the site where you want to delete unused records, and click Settings.

Scenario limitations with managed keychain

Three scenarios are not supported when using managed keychain OAuth with Tableau Server:

  • Prompting for OAuth credentials on live connections. Users must embed credentials on live connections with managed-keychain OAuth.
  • Editing the OAuth data source connection on Tableau Server.
  • Web authoring.

Converting managed keychain to saved credentials

You can convert the connectors that use managed keychain to use saved credentials by configuring Tableau Server with an OAuth client ID and secret for each connector. By converting these connectors to saved credentials, users will be able to manage their credentials for each connector type on My Account Settings page on Tableau Server. Additionally, live connection prompts, editing connections, and web authoring are also supported.

Thanks for your feedback!