Skip to main content
Topics#Tableau ServerPregunta de Mahmut Onat
Mahmut Onat ha preguntado en #Tableau Server
29 sept, 11:58

How to enforce user-level Oracle permissions in Tableau Server using Kerberos / AD Tickets without generic service accounts?

Hi Tableau Community,

I am looking for best practice guidance on configuring authentication between Tableau Server and an Oracle Database in an enterprise environment while strictly enforcing individual user permissions.

Current Environment & Workflow:

  1. Current State: We currently use static database usernames/passwords for connection, but we want to migrate away from static credentials entirely.
  2. Desktop Client: In Toad/Tableau Desktop, developers connect to Oracle via Integrated Authentication / Kerberos (AD Tickets). They run a local script to generate an Active Directory ticket and connect seamlessly without entering database passwords.
  3. Tableau Server: Tableau Server is currently running under a default setup.

The Challenge:

If we use a single generic account (like the Server Run As account) to connect to Oracle, every developer and end-user on Tableau Server gains access to all tables through that single identity.

We do not want a shared service account with broad access. We need each user/developer on Tableau Server to access only the specific Oracle tables they are individually authorized to see in Active Directory / Oracle.

What We Want to Achieve:

  • Pass-Through Authentication: Migrate from static database credentials to a ticket-based AD/Kerberos mechanism on Tableau Server.
  • No Database Passwords: Avoid sharing or embedding static database passwords in workbooks or Server connections.
  • User-Level Authorization: Ensure that when a workbook is viewed or published, the connection to Oracle honors the logged-in user's individual AD/Kerberos permissions (Viewer Credentials).

Questions:

  1. Is Kerberos Constrained Delegation between Tableau Server and Oracle the recommended architecture to pass the logged-in user's AD identity directly to Oracle?
  2. If Kerberos Delegation is configured, how are Extract Refreshes handled for user-specific data sources without static service passwords?
  3. Are there alternative patterns (e.g., Oracle Proxy Authentication or Published Data Sources with RLS) to enforce table-level Oracle security while keeping the experience passwordless for users?

Any guidance, architectural best practices, or official configuration references would be greatly appreciated!

Thanks in advance. 

 

#Tableau Server

1 respuesta
  1. Emeric LE SAULNIER DE SAINT JOUAN
    29 sept, 15:20

    Hi @Mahmut Onat

     

    about your questions: 

    1) I would rather say it is your only option 

    2) Kerberos is an interactive authentication type. It cannot handle Extracts back-end refreshes. For extracts use-case, you must keep username / pass authentication. 

    3) You can use published datasource RLS, but then you use Tableau features so the "logic" is on Tableau side, supported by an entitlement table on Oracle side.

Escribir una respuesta...
0/9000