OAuth 2.0 Trust (Okta) Setup

How to integrate Okta with Rapid BI Catalog for Tableau Connected Apps with OAuth 2.0 Trust.

OAuth 2.0 TrustOktaEASAdmin only

Connected Apps with OAuth 2.0 Trust integrates Rapid BI Catalog with your identity provider so it can authenticate Tableau users on their behalf. This guide is written for Okta, which is currently validated for OAuth 2.0 Trust because it provides the authorization‑server capabilities Tableau Connected Apps require. You configure OAuth 2.0 Trust per site (or per server) in BI Server Configuration.

Prerequisite — SSO
OAuth 2.0 Trust relies on SSO login. Configure OIDC SSO first; you can reuse the same Okta application for both Rapid BI Catalog login and Tableau, or create a dedicated application.

Server‑wide vs site‑level

The scope of the authorization server depends on your Tableau environment, and it also sets the audience value:

  • Server‑wideonly available for Tableau Server: one authorization server (EAS) for the entire server; audience tableau.
  • Site‑levelrequired for Tableau Cloud: one authorization server per site; audience tableau:<site_luid>.

Authorization server & scopes

In Okta, create a custom authorization server (the EAS) and add these scopes to it:

ScopeWhy it is needed
tableau:content:readRead Tableau content
tableau:projects:readList projects
tableau:workbooks:downloadDownload workbooks for documentation
offline_accessIssue a refresh token so Rapid BI Catalog can refresh silently (no repeated prompts)
Access‑token lifetime
In the Okta Access Policy, set the access‑token lifetime to 9 minutes or less. Tableau rejects an access token older than ~10 minutes; this is an identity‑provider setting that Rapid BI Catalog cannot enforce.

Application & redirect URIs

Use the OIDC application that backs Rapid BI Catalog login, or create a dedicated one. Add both of these Sign‑in redirect URIs (replace <bi-catalog-url> with your domain):

  • https://<bi-catalog-url>/api/v1/sso/oidc/callback
  • https://<bi-catalog-url>/api/v1/sso/caoa/callback

Audience values

EnvironmentAudience
Tableau Servertableau
Tableau Cloudtableau:<site_luid>

Pop‑ups

The first time a user connects (or after a long absence), a one‑time sign‑in window may open. Users must allow pop‑ups for the Rapid BI Catalog domain. Routine re‑authentication is silent and requires no user action.

Next Steps