Tableau Single Sign On (SSO)

What is Tableau?

Tableau is a powerful business intelligence tool used for data visualizations in the form of charts, graphs, and so on to gain business insights for the better development of a company. It is much interactive tool which can help business managers, team leaders to make more appropriate decisions speedily. Tableau also helps in the reduction of big data into small data, as well as the interpretation and actionability of small data. It can help non technical staff also to create customized dashboards for their work. The drag and drop interface of Tableau makes it really fast.

Single Sign-On (SSO) solution by miniOrange provides secure Single Sign-On access into Tableau using a single set of login credentials. You can log into Tableau using miniOrange credentials or Azure AD credentials or any of your existing identity providers. With miniOrange SSO services, along with Tableau you can also login into other On-Premise and Cloud Applications using your existing Identity Providers/User Store (Azure Active Directory, Okta, Ping) credentials. Follow the given setup guide to integrate SAML SSO for your Tableau account.

Login into Tableau using Website credentials

Our miniOrange saml IDP plugin allows you to login into Tableau with the website credentials. You need to install this plugin in your website and configure with Tableau.

Step by step guide to set up Tableau as SP use Website credentials to login:

Step 1: Add SAML authentication method in Tableau and get metadata

• Log in to your Tableau Dashboard as Admin.
• Go to Authentication Settings in the Settings menu.




• Enable SAML authentication by checking the Single Sign On (SSO) with SAML checkbox.
• Click on edit connection




• Note down the Tableau Entity ID and Assertion Consumer Service URL (ACS URL) which will be needed to configure the plugin.
  Note: If your Tableau SP is configured to send Signed Requests then you will need to provide the certificate in the plugin as well. You can get the certificate from the Tableau Metadata.





Step 2: Configure miniOrange SAML IDP plugin for your website

• In miniOrange SAML IDP plugin, go to Service Providers tab.




• Enter the following values:



Service Provider Name	Choose appropriate name according to your choice
SP Entity ID or Issuer	Tableau Entity ID
ACS URL X.509 Certificate (optional)	Tableau Assertion Consumer Service URL
For Signed Request	Paste certificate value you copied from the Tableau Metadata file
NameID Format	Select urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Response Signed	Unchecked
Assertion Signed	Checked
Encrypted Assertion	Unchecked



• You will need to upload the IdP metadata or give certain IdP information in Tableau.




• You can get this information from the IDP metadata tab in the plugin.





Step 3: Configure user attributes

• You will need to configure user attributes to be sent in the SAML response which Tableau needs to log in the user. You can do this under the Attribute/Role Mapping Tab in the plugin. Note the Attributes required from Tableau.




• Configure the plugin to send relevant user details.
  Please Note: The name you provide in the plugin for each attribute has to match the name being asked in the plugin dashboard.




• Select users you want to enable SSO in the Tableau dashboard.



• Click on the Test Login button in the Tableau Dashboard to Test the SSO configuration.



• You can see the following screen after a successful SSO configuration.

Login into Tableau from External Identity Sources

In this case miniOrange will act as a broker between the customer’s IdP and the applications (e.g WordPress and Tableau).The miniOrange SAML plugin and the Tableau site will be configured with miniOrange as broker. Customer IdP will be configured as an authentication source in the miniOrange.

Workflow:

1. Login into the WordPress site using miniOrange SAML IdP credentials.

2. In the Login with SAML case, the plugin will send a SAML Request to the miniOrange IdP and miniOrange IdP will forward this request to the corresponding customer’s IdP. All this happens behind the scene and the user will only see their corresponding IdP’ login page upon clicking on the Login with SAML link.

3. After successful authentication, the customer’s IdP will send a SAML Response to the WordPress site through miniOrange IdP. And the user gets redirected and logged in to the WordPress site

4. When the user clicks on the Tableau link present on the WordPress site, the Tableau site will send a SAML Request to the miniOrange IdP and miniOrange will forward this request to the corresponding customer’s IdP.

5. Since the user session already exists at the IdP, the user will not be prompted to login again.

6. Upon receiving the request, the customer’s IdP will send the SAML Response to the Tableau site through miniOrange and the user gets logged into the Tableau site as well.

Step by step guide to set up Tableau as SP and have multiple IDPs:

Step 1:Add SAML authentication method in Tableau and get metadata.

• Follow step 1 from previous usecase



Step 2: Configure Tableau in miniOrange

• From your miniOrange dashboard, go to app -> configure apps
  
  



• Search for tableau app





• You can choose to Import metadata and browse the file dowloaded in step 1 OR
• Enter the following values:

Service Provider Name	Choose appropriate name according to your choice
SP Entity ID or Issuer	Tableau Entity ID
ACS URL X.509 Certificate (optional)	Tableau Assertion Consumer Service URL
For Signed Request	Paste certificate value you copied from the Tableau Metadata file
NameID Format	Select urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Response Signed	Unchecked
Assertion Signed	Checked
Encrypted Assertion	Unchecked




Step 3: Import IDP metadata in Tableau

• You need to upload the IdP metadata or give certain IdP information in Tableau.
• You can get this information from the Metadata Tab in the plugin you configured.
• Here you will have two options to download metadata.
• One when you choose miniOrange as IDP and second would be for external IDP i.e for miniOrange as broker






• Next step is to upload the file in tableau.
• Browse for the file and then click on Apply.




Step 4: Configure user attributes

• Same as the step 3 in above usecase.

Embedded views :

Steps to set up Tableau for embedded views in IFrame:

• After following above steps to Single Sign-On (SSO) in Tableau select Default Authentication Type of Embedded Views to Authenticate using an inline frame from Authentication Settings.






• Note as shown is above image this feature is not supported by all IDPs.
• Go to your Tableau View and select the view you desire to show in an Iframe.




• Select the Share option from the top right corner section of your view. Copy the Embed Code or Link.
• You can use the embed code or link to load the view in an Iframe.

For Further Details:

What is SSO
What is SAML
Tableau SAML Configuration

Tableau Two-Factor Authentication