Connected Apps with OAuth 2.0 Trust integrates Rapid BI Catalog with your identity provider so it can authenticate Tableau users on their behalf. This guide is written for Okta, which is currently validated for OAuth 2.0 Trust because it provides the authorization‑server capabilities Tableau Connected Apps require. You configure OAuth 2.0 Trust per site (or per server) in BI Server Configuration.
Server‑wide vs site‑level
The scope of the authorization server depends on your Tableau environment, and it also sets the audience value:
- Server‑wide — only available for Tableau Server: one authorization server (EAS) for the entire server; audience
tableau. - Site‑level — required for Tableau Cloud: one authorization server per site; audience
tableau:<site_luid>.
Authorization server & scopes
In Okta, create a custom authorization server (the EAS) and add these scopes to it:
| Scope | Why it is needed |
|---|---|
tableau:content:read | Read Tableau content |
tableau:projects:read | List projects |
tableau:workbooks:download | Download workbooks for documentation |
offline_access | Issue a refresh token so Rapid BI Catalog can refresh silently (no repeated prompts) |
Application & redirect URIs
Use the OIDC application that backs Rapid BI Catalog login, or create a dedicated one. Add both of these Sign‑in redirect URIs (replace <bi-catalog-url> with your domain):
https://<bi-catalog-url>/api/v1/sso/oidc/callbackhttps://<bi-catalog-url>/api/v1/sso/caoa/callback
Audience values
| Environment | Audience |
|---|---|
| Tableau Server | tableau |
| Tableau Cloud | tableau:<site_luid> |
Pop‑ups
The first time a user connects (or after a long absence), a one‑time sign‑in window may open. Users must allow pop‑ups for the Rapid BI Catalog domain. Routine re‑authentication is silent and requires no user action.
Next Steps
- Configure SSO: SSO Configuration
- Compare methods: Tableau Connected Apps
- Apply it to a site: BI Server Configuration