Tableau Connected Apps

The two Tableau Connected App authentication methods Rapid BI Catalog supports, and how to choose between them.

Direct TrustOAuth 2.0 TrustJWTAdmin only

Each Tableau site you configure authenticates end users with a Tableau Connected App. Rapid BI Catalog supports two methods, chosen per site in BI Server Configuration: Connected Apps with Direct Trust and Connected Apps with OAuth 2.0 Trust. Both produce a short‑lived Tableau token used to download the selected content; they differ in how that token is obtained and how a user's Tableau identity is determined.

Connected Apps with Direct Trust

With Direct Trust, Rapid BI Catalog signs a short‑lived JWT locally (valid for about five minutes) using the Tableau Connected App secret you configure on the site. No call to an identity provider is made.

  • Identity comes from User Discovery. The user's Tableau username is taken from the User Discovery snapshot, matched on the user's email. A user who has not been discovered for a site cannot obtain a token.
  • Keep the server clock accurate. Because the JWT carries a short expiry, the Rapid BI Catalog server's clock should be synchronised (NTP).
  • No identity provider is required, which makes Direct Trust a good fit when SSO is not in use.
Each user needs the correct email in Tableau
Direct Trust matches users by email, so every user must have their correct email address set in Tableau. A user whose Tableau email is missing or incorrect cannot be discovered — and an administrator will not be able to invite or map that user for a Direct Trust site.

Connected Apps with OAuth 2.0 Trust

With OAuth 2.0 Trust, Rapid BI Catalog does not sign the token itself. Instead it obtains a Tableau‑scoped token from your identity provider's authorization server (an External Authorization Server, EAS) using OAuth, on behalf of the signed‑in user.

  • Per‑user tokens. Each user authorises once; tokens are stored and refreshed automatically.
  • Re‑authentication is silent. Tokens are pre‑warmed at login and refreshed in the background — users are not asked to take any action in normal use.
  • OAuth 2.0 Trust depends on SSO login. It works for users who sign in via SSO; local username/password users cannot use OAuth 2.0 Trust. Detailed configuration is on the OAuth 2.0 Trust (Okta) Setup page.

Choosing a method

Direct TrustOAuth 2.0 Trust
Token sourceSigned locally by Rapid BI CatalogIssued by your IdP authorization server
User identityFrom User Discovery (email match)From the user's SSO identity (email), automatically
Identity providerNot requiredRequired (SSO); see OAuth 2.0 Trust (Okta) Setup
PrerequisiteRun User Discovery firstSSO login configured; users allow pop‑ups once
Clock dependencyServer clock must be accurate (NTP)Handled by the IdP

Scheduled jobs do not use either method for the download itself — they use a Service Account.

Next Steps