Configuration Guides

Configuring SCIM 2.0 provisioning with Tableau and PingFederate

Learn how to enable Tableau SCIM 2.0 Provisioning in PingFederate.

Before you begin

  • Configure PingFederate to authenticate against an LDAP identity repository containing the users requiring application access.

  • Configure PingFederate with the SCIM provisioning connector to support the SCIM 2.0 protocol.

  • Configure PingFederate with the Tableau SP connection.

  • Configure the PingFederate run.properties file to support provisioning.

Enable SCIM provisioning in Tableau

  1. Sign on to Tableau with an administration account.

  2. Go to Settings → Authentication.

  3. In the Automatic Provisioning and Group Synchronisation (SCIM) section, select the Enable SCIM check box.

  4. Click Generate New Secret.

    This will generate a new API secret that PingFederate will use to authenticate to the Tableau SCIM endpoint.

    Screen capture of Tableau automatic provisioning and group synchronization section to generate a new secret.

Enable SCIM provisioning in the SP connection

  1. In the PingFederate administrative console, select the Tableau SP connector.

  2. On the Connection Type tab, select the Outbound Provisioning check box and in the Type list, select SCIM Connector.

    Screen capture of PingFederate SP Connections page with SCIM Connector selected as the connection type with Outbound Provisioning and Browser SSO Profiles also selected.

  3. On the Outbound Provisioning tab, select Configure Provisioning.

  4. On the Target tab, in the SCIM Version list, select 2.0 and enter the SCIM URL and OAuth 2 Bearer Token obtained from Tableau.

    Screen capture of PingFederate SP Connection channel configuration.

  5. Define a channel to obtain the user details:

    1. Add the LDAP source and source location according to your user data source.

      Screen capture of PingFederate SP Connection channel configuration with PingDirectory selected as the active LDAP data store.
      Screen capture of PingFederate SP Connection channel data store source settings.
      Screen capture of PingFederate channel configuration with source location settings.

    2. Configure attribute mappings.

      The SCIM userName field must map to an email address.

      + image::ixz1640220648501.png[alt="Screen capture of PingFederate SP Connection channel attribute mapping page.",role="border-no-padding"]

    3. Enable the channel.