How Trusted Authentication Works in Tableau Server

The diagram below describes how trusted authentication works between the client's web browser, your web server(s) and Tableau Server.

	User visits the webpage: When a user visits the webpage with the embedded Tableau Server view, it sends a GET request to your web server for the HTML for that page.		Web server passes the URL to the browser: The web server constructs the URL for the view using either the view’s URL or its object tag (if the view’s embedded), and inserts it into the HTML for the page. The ticket is included (e.g., http://tabserver/trusted/<ticket>/views/requestedviewname). The web server passes all the HTML for the page back to the client’s web browser.
	Web server POSTS to Tableau Server: The web server sends a POST request to Tableau Server. That POST request must have a username parameter. Theusername value must be the username for a licensed Tableau Server user. If the server is running multiple sites and the view is on a site other than the Default site, the POST request must also include a target_siteparameter.		Browser requests view from Tableau Server: The client web browser sends a request to Tableau Server using a GET request that includes the URL with the ticket.
	Tableau Server creates a ticket: Tableau Server checks the IP address of the web server (192.168.1.XXX in the above diagram) that sent the POST request. If it is set up as a trusted host then Tableau Server creates a ticket in the form of a unique nine-digit string. Tableau Server responds to the POST request with that ticket. If there is an error and the ticket cannot be created Tableau Server responds with a value of -1.		Tableau Server redeems the ticket: Tableau Server sees that the web browser requested a URL with a ticket in it and redeems the ticket. Tickets must be redeemed within three minutes after they are issued. Once the ticket is redeemed, Tableau Server logs the user in, removes the ticket from the URL, and sends back the final URL for the embedded view.