2 Replies Latest reply on Oct 8, 2015 7:37 AM by emmanuel.owusu

    Kerberos authentication with Cubes


      We are currently in the process of moving most of our dashboards from development into production. We have already established how we want our users to access the dashboards . Here is a little bit of insight into what we plan on doing;


      We built a reporting portal where our users can access the dashboards. Our reporting portal is designed to show dashboards to external users who are not logged into the company network or via VPN, but do have an Active Directory User ID on our network

      To accomplish this we currently have a dot-net web interface (which will be changed to SharePoint-2013 in near future).


      This is the procedure to be followed when any User accesses the dashboard portal.


      1. The User will access web portal from anywhere.

         2. The User will enter his AD login and be shown a dashboard reporting portal web page with dashboard images, each carrying a             particular dashboard link.

         3. When the User clicks on a particular dashboard image it will pass the User credentials along with the URL of the dashboard            chosen and Tableau needs to identify that particular User and authorize the User credentials on the Tableau server (without asking      for the User credentials again) and show the User the specified dashboard. We have implemented Kerberos on our Tableau server to    access an SSAS Cube data source and show the appropriate data for that particular User.


      After we implemented Kerberos, we  have been experiencing some setbacks.


      1. We are experiencing greater load times when we sign into our Tableau server. On average it is taking 45 to 60 seconds to render the content page. This is obviously  unacceptable, especially since we will have hundreds of users accessing our dashboards. 
      2. We are receiving the error message below from our Share Link on all dashboards. These links will be provided to the end Users and will be embedded into the dashboard images.




      1. From the information provided above, we need guidance on:
      2. How to pass credentials from the dashboard website (Dot-net or SharePoint) to the tableau Server. As stated above, our goal is to have the user sign on once only.
      3. How to implement opening the Dashboard link without any error.
      4. How to reduce the time to Load the Dashboard





      Diego medrano do you know anybody that can help?

        • 1. Re: Kerberos authentication with Cubes

          Hey Emmanuel,


          While a question of this complexity is probably better suited to support or our Professional Services team, I may have found some useful information from a colleague:


          2. In this scenario trusted authentication is the best way to go: SharePoint will send us a username and we accept it. I believe trusted auth works fine with Kerberos, but I haven't tested it.


          3. This error in most cases means that something is configured incorrectly in the AD and we cannot request or redeem a Kerberos ticket. Best course of actions is to open a support case


          4. Once 3 is resolved, performance could go back to normal. If not we should compare TS performance with TD. If TD shows the same speed - work on workbook design. If TS is slower - look at hardware TS is running on.


          I hope this helps!



          1 of 1 people found this helpful
          • 2. Re: Kerberos authentication with Cubes

            Hey Diego, sorry for the late response. We implemented Trusted authentication but came to the realization that it doesn't work with Kerberos.


            We have been able to figure out why we were getting the error prompt. It has been fixed, Thank you.


            But we still don't have a way a getting the dot.net to talk to tableau. it needs to be able to pass on its AD Credentials so tableau doesn't prompt for it again. We want to achieve a single sign on instead of dual. Does tableau have any plugins or anything that might help?

            1 of 1 people found this helpful