Tableau Server requires an identity store to store user and group information. Review Authentication and Identity Store topics before configuring the identity store for the first time. After you have installed the identity store on Tableau Server, you cannot change it without reinstalling the server.
Important:Â All entity options are case sensitive.
Before you beginReview the following information:
If you will not be using the local identity store, then you will be using some version of LDAP. In this case, work with your directory/LDAP administrator to configure Tableau Server for your LDAP schema and bind requirements.
Tableau Server configuration is optimized for Active Directory. If you are installing into Active Directory, we recommend configuring the identity store with Configure Initial Node Settings.
LDAPÂ bind is independent of user authentication. For example, you can configure Tableau Server to use simple bind to authenticate to the LDAP directory and then configure Tableau Server to authenticate users with Kerberos after installation.
Do not connect to LDAP with simple bind over an unsecured connection. By default, LDAPÂ with simple bind sends data in cleartext. Use LDAPS to encrypt traffic with simple bind. See Configure Encrypted Channel to LDAP External Identity Store.
To use Kerberos authentication for the LDAPÂ bind with Tableau Server service, then you'll need a keytab file for GSSAPIÂ bind, as described in the sections below. See also, Understanding Keytab Requirements. In the context of Kerberos, GSSAPI bind is all you need during the base installation of Tableau Server. After you install the server, you can then configure Kerberos for user authentication and Kerberos delegation to data sources.
In this topic, we make the distinction between LDAP (the protocol for connecting to directory services) and an LDAP server (an implementation of a directory service). For example, slapd is an LDAP server that is part of the OpenLDAP project.
Validate the LDAP configuration before initializing the server, see Configure Initial Node Settings.
Import JSON configuration files only as part of the initial configuration. If you need to make LDAPÂ changes after you have imported the JSONÂ configuration file and initialized Tableau Server, do not attempt to re-import the JSONÂ file. Rather, make individual key changes with native tsm commands or with tsm configuration set. See External Identity Store Configuration Reference.
The JSON templates in this section are used to configure Tableau Server with different identity store scenarios. Unless you're configuring a local identity store, you will need to select and edit a configuration file template that is specific to your LDAP environment.
Consider using the Tableau Identity Store Configuration Tool(Link opens in a new window) to help generate your LDAPÂ JSON configuration file. The tool itself is not supported by Tableau. However, using a JSON file created by the tool instead of creating a file manually does not change the supported status of your server.
Select an identity store configuration template to edit:
For more explanation about configuration files, entities, and keys see Configuration File Example.
LocalConfigure local as the identity store type if your organization does not already have an Active Directory or LDAP server for user authentication. When you select local as the identity store type, you use Tableau Server to create and manage users.
An alternative way to configure Tableau Server for local identity store is to run Setup GUI and select "Local" during the installation process. See Configure Initial Node Settings.
{
"configEntities": {
"identityStore": {
"_type": "identityStoreType",
"type": "local"
}
}
}
Important
The LDAPÂ configuration templates below are examples. The templates, as presented, will not configure LDAP connectivity in your organization. You must work with your directory administrator to edit the LDAP template values for a successful deployment.
Additionally, all files that are referenced in configEntities must be located on the local computer. Do not specify UNC paths.
LDAP - Active DirectoryTableau Server configuration is optimized for Active Directory. If you are installing into Active Directory, configure the identity store with Configure Initial Node Settings.
An encrypted connection to Active Directory is required.See Configure Encrypted Channel to LDAP External Identity Store.
If for some reason you are unable to configure the identity store to communicate with Active Directory with TSMÂ web interface, use this JSON template to configure Tableau Server to connect to Active Directory. This template uses GSSAPI (Kerberos) bind to authenticate Tableau Server service to Active Directory. Tableau Server includes support for Active Directory schema. Therefore, if you set the "directoryServiceType" option to "activedirectory" then you do not need to provide schema info in the "identityStoreSchemaType" option.
If you are installing Tableau Server for Linux into Active Directory, and the computer where you are installing Tableau Server is already joined to the domain, then the computer will already have a Kerberos configuration file and a keytab file. Strictly speaking, you can use these files for GSSAPIÂ bind, but we don't recommend using them. Instead, contact your Active Directory administrator and request a keytab specifically for the Tableau Server service.
{
"configEntities":{
"identityStore": {
"_type": "identityStoreType",
"type": "activedirectory",
"domain": "your-domain.lan",
"nickname": "YOUR-DOMAIN-NICKNAME",
"directoryServiceType": "activedirectory",
"bind": "gssapi",
"kerberosKeytab": "<path to local key tab file>",
"kerberosConfig": "/etc/krb5.conf",
"kerberosPrincipal": "your-principal@YOUR.DOMAIN"
}
}
}
We recommend binding to Active Directory with GSSAPI. However, you can connect with simple bind and LDAPS. To connect with simple bind, change bind to simple, remove the three Kerberos entities, and add the port/sslPort, username, and password options. The following example shows Active Directory with simple bind json.
{
"configEntities":{
"identityStore": {
"_type": "identityStoreType",
"type": "activedirectory",
"domain": "your-domain.lan",
"nickname": "YOUR-DOMAIN-NICKNAME",
"directoryServiceType": "activedirectory",
"hostname": "optional-ldap-server",
"sslPort": "636",
"bind": "simple",
"username": "username",
"password": "password"
}
}
}
OpenLDAP - GSSAPI bind
Use the template below to configure OpenLDAP with GSSAPI bind. Do not use this template if your organization is running Active Directory. If you are installing into Active Directory, use the template above, LDAP - Active Directory.
In most cases, organizations that use OpenLDAP with GSSAPI (Kerberos) will use a keytab file to store credentials. In the following example, a keytab file is used for authentication credentials.
However, you can provide credentials through the username and password entities.
You can also specify both a keytab and a username and password pair. In this case, Tableau Server will attempt to use the keytab, but if authentication fails for any reason it will fallback and use the username and password credentials.
{
"configEntities":{
"identityStore": {
"_type": "identityStoreType",
"type": "activedirectory",
"domain": "your-domain.lan",
"nickname": "YOUR-DOMAIN-NICKNAME",
"directoryServiceType": "openldap",
"bind": "gssapi",
"kerberosKeytab": "<path to local key tab file>",
"kerberosConfig": "/etc/krb5.conf",
"kerberosPrincipal": "your-principal@YOUR.DOMAIN",
"identityStoreSchemaType": {
"userBaseFilter": "(objectClass=inetOrgPerson)",
"userUsername": "user",
"userDisplayName": "displayname",
"userEmail": "email",
"userCertificate": "certificate",
"userThumbnail": "thumbnail",
"userJpegPhoto": "photo",
"groupBaseFilter": "(objectClass=groupofNames)",
"groupName": "groupname",
"groupEmail": "groupemail",
"groupDescription": "groupdescription",
"member": "member",
"distinguishedNameAttribute": "",
"serverSideSorting": "",
"rangeRetrieval": "",
"userClassNames": ["inetOrgPerson","someClass2"],
"groupClassNames": ["groupOfUniqueNames1","groupOfUniqueNames2"]
}
}
}
}
OpenLDAP - Simple bind
{
"configEntities":{
"identityStore": {
"_type": "identityStoreType",
"type": "activedirectory",
"domain": "my.root",
"nickname": "",
"hostname": "optional-ldap-server",
"port": "389",
"directoryServiceType": "openldap",
"bind": "simple",
"username": "cn=username,dc=your,dc=domain",
"password": "password",
"identityStoreSchemaType": {
"userBaseFilter": "(objectClass=inetOrgPerson)",
"userUsername": "user",
"userDisplayName": "displayname",
"userEmail": "email",
"userCertificate": "certificate",
"userThumbnail": "thumbnail",
"userJpegPhoto": "photo",
"groupBaseFilter": "(objectClass=groupofNames)",
"groupName": "groupname",
"groupEmail": "groupemail",
"groupDescription": "groupdescription",
"member": "member",
"distinguishedNameAttribute": "",
"serverSideSorting": "",
"rangeRetrieval": "",
"userClassNames": ["inetOrgPerson","someClass2"],
"groupClassNames": ["groupOfUniqueNames1","groupOfUniqueNames2"]
}
}
}
}
Configuration template reference
local or activedirectory. (If you want to connect to any LDAP server, select activedirectory.)
nickname option is required for all LDAPÂ entities. If your organization does not require a nickname/NetBIOS, then pass a blank key, for example:Â "nickname": "".
activedirectory or openldap.
/var/opt/tableau/keytab directory.
/etc/krb5.keytab. Rather, we recommend that you register a new service principal name. To see principals in a given keytab, run the klist -k command. See Understanding Keytab Requirements.
activedirectory or openldap.
jsmith. For LDAP servers, enter the distinguished name (DN) of the user that you want to use to connect. For example, you might enter cn=username,dc=your-local-domain,dc=lan.
If you're enabling LDAPS in Active Directory and connecting to subdomains, you'll need to run the following TSM command to configure the LDAPS port (TCP 636) for subdomains. The command takes arguments that specify subdomainFQDN:port.
Example: tsm configuration set -k wgserver.domain.ldap.domain_custom_ports -v subdomain1.lan:636,subdomain2.lan:636,subdomain3.lan:636
For more information, see tsm configuration set Options.
Shared LDAP optionsThe following options can be set for generic LDAP, OpenLDAP, or Active Directory implementations.
gssapi for GSSAPI (Kerberos).
root
example.lan, the root would be "o=example,u=lan".
identityStoreSchemaType options
If you configure an LDAP connection to an LDAP server, you can enter schema information specific to your LDAP server in the identityStoreSchemaType object.
Important If you are connecting to Active Directory ("directoryServiceType": "activedirectory"), then do not configure these options.
true. If you are unsure whether your LDAPÂ server supports this, enter false, as misconfiguration may cause errors.
true. If you are unsure whether your LDAPÂ server supports range retrieval, enter false, as misconfiguration may cause errors.
["basegroup","othergroup"].
["userclass1",userclass2â].
After you have finished editing the JSON file, pass the file and apply settings with the following commands:
tsm settings import -f path-to-file.json
tsm pending-changes apply
If the pending changes require a server restart, the pending-changes apply command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the --ignore-prompt option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see tsm pending-changes apply.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4