Skip to main content
Topics#Tableau ServerMahmut Onat's Question
Mahmut Onat asked in #Tableau Server
Today, 11:58 AM

How to enforce user-level Oracle permissions in Tableau Server using Kerberos / AD Tickets without generic service accounts?

Hi Tableau Community,

I am looking for best practice guidance on configuring authentication between Tableau Server and an Oracle Database in an enterprise environment while strictly enforcing individual user permissions.

Current Environment & Workflow:

  1. Current State: We currently use static database usernames/passwords for connection, but we want to migrate away from static credentials entirely.
  2. Desktop Client: In Toad/Tableau Desktop, developers connect to Oracle via Integrated Authentication / Kerberos (AD Tickets). They run a local script to generate an Active Directory ticket and connect seamlessly without entering database passwords.
  3. Tableau Server: Tableau Server is currently running under a default setup.

The Challenge:

If we use a single generic account (like the Server Run As account) to connect to Oracle, every developer and end-user on Tableau Server gains access to all tables through that single identity.

We do not want a shared service account with broad access. We need each user/developer on Tableau Server to access only the specific Oracle tables they are individually authorized to see in Active Directory / Oracle.

What We Want to Achieve:

  • Pass-Through Authentication: Migrate from static database credentials to a ticket-based AD/Kerberos mechanism on Tableau Server.
  • No Database Passwords: Avoid sharing or embedding static database passwords in workbooks or Server connections.
  • User-Level Authorization: Ensure that when a workbook is viewed or published, the connection to Oracle honors the logged-in user's individual AD/Kerberos permissions (Viewer Credentials).

Questions:

  1. Is Kerberos Constrained Delegation between Tableau Server and Oracle the recommended architecture to pass the logged-in user's AD identity directly to Oracle?
  2. If Kerberos Delegation is configured, how are Extract Refreshes handled for user-specific data sources without static service passwords?
  3. Are there alternative patterns (e.g., Oracle Proxy Authentication or Published Data Sources with RLS) to enforce table-level Oracle security while keeping the experience passwordless for users?

Any guidance, architectural best practices, or official configuration references would be greatly appreciated!

Thanks in advance. 

 

#Tableau Server

Write an answer...
0/9000