In the process of configuring OpenID Connect for Tableau Server, what is a critical step to ensure secure and efficient authentication?
A. Configuring the Tableau Server to accept all OpenID Connect providers without validation
B. Registering Tableau Server as a client with the OpenID Connect provider and obtaining client credentials
C. Setting up a direct database connection from Tableau Server to the OpenID Connect provider's database
D. Disabling all other forms of authentication on Tableau Server to enforce OpenID Connect exclusively
B. Registering Tableau Server as a client with the OpenID Connect provider and obtaining client credentials
Explanation:
Why B is Correct?
Client registration is mandatory for OpenID Connect (OIDC) to establish a trusted relationship between Tableau Server and the OIDC provider (e.g., Azure AD, Okta).
This step provides:
Client ID and secret: Used to authenticate Tableau Server with the provider.
Scopes/permissions: Defines what user data (e.g., email, groups) Tableau can access.
Tableau’s OIDC Documentation lists this as the first configuration step.
Why Other Options Are Incorrect?
A. Accepting all providers: A severe security risk—only pre-approved providers should be trusted.
C. Direct database connection: OIDC uses API-based authentication, not direct database access.
D. Disabling all other auth methods: Overly restrictive—some users (e.g., admins) may need local access for troubleshooting.
Key Steps for Secure OIDC Setup:
Register Tableau Server in your OIDC provider’s portal (e.g., Azure AD App Registrations).
Configure redirect URIs: Must match exactly (e.g., https://tableau.example.com/oidc/callback).
Obtain credentials: Client ID, secret, and issuer URL..
Reference:
OpenID Connect Core 1.0 Spec.
Final Note:
B is the only secure and standards-compliant approach. Options A/C/D either compromise security or misrepresent OIDC’s design. Always validate provider credentials.