3 Replies Latest reply on Mar 22, 2018 3:43 PM by Bryan Sheasby

    Guest access with SSO

    Arvind Ravindran

      We have a Tableau server in our organization with SSO activated through Identity NOW. Since SSO was involved, we assumed that the guest username cannot log in, and sure enough, there is no last sign in date against the Guest username. However, when I was looking at usage statistics for various workbooks, I noticed that the guest username has been accessing the workbooks quite frequently. So my question is, how is this possible? Is this an unauthorized access that is being recorded against this username? Is there any way one can access workbooks on the server bypassing the SSO? I've disabled the guest user on the server, but want to be absolutely sure that nobody is able to log in without going through the SSO.

        • 1. Re: Guest access with SSO
          Andrew Macey

          It took me a while to get a handle on Guest access & gotchas, but these tips might help. Comments/corrections welcomed.

           

          - As of Server 10.2, Guest access can be controlled at the Site level. Guest cant browse server content.

          - When you include :embed=y in the URL to a view (like when you embed a view in a page or copy the link via the Share button e.g."http: //myserver/views/workbook1/view1?:embed=y&:showShareOptions=true&:display_count=no&:showVizHome=no") then when a user opens the view, they get treated as Guest (even if they are a valid Site user), unless they already have an unexpired session cookie for that site in their current browser, in which case they get treated as the identified Site user.

          - To avoid Guest access to specific content, explicitly deny Guest access in your project/workbook/view permissions. Disabling Guest at Server/Site level should be sufficient if you want Server/Site level.

          - Beware granting "All Users" access to any project/content as it includes Guest. Default project grants access to "All Users"

          1 of 1 people found this helpful
          • 2. Re: Guest access with SSO
            Toby Erkson

            Andrew Macey wrote:

             

            It took me a while to get a handle on Guest access & gotchas, but these tips might help...

            - When you include :embed=y in the URL to a view ... then when a user opens the view, they get treated as Guest (even if they are a valid Site user), unless they already have an unexpired session cookie for that site in their current browser, in which case they get treated as the identified Site user.

            ...

            Huh, that's interesting.  I would've assumed that the user's ID would be used.  Thinking out loud: I wonder if "Enable automatic logon" matters?

            • 3. Re: Guest access with SSO
              Bryan Sheasby

              I think it does matter. I'm here because I'm tacking the opposite problem. I enabled guest access but it is not working because even on embedded pages as it is trying to login the user automatically. There is then no way to switch to guest access at that point. So I think this is what you want. I am testing it now to make sure that check box is why users are seeing the login screen. I should add that the users seeing the login screen are users NOT defined in the system.