---
schema_version: "1"
id: 1c48f8e255ccf9185d96d7b36d16d429ccdc679bfd373ddd65093d003f096fc0
title: openIDSettings Entity
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/server-linux/entity_openid.md
canonical_url: https://help.tableau.com/current/server-linux/en-gb/entity_openid.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 2995862a441fe8da8dd0a3b6ad46a4104a3478bb9879ac3b1726cc28464c3ea0
description: Reference for the openIDSettings entity to configure OpenID Connect authentication via JSON.
---
[Skip to main content](#main-content)

# openIDSettings Entity

Before you configure OpenID authentication, review [Requirements for Using OpenID Connect](https://help.tableau.com/current/server-linux/en-gb/openid_auth_requirements.htm).

Use the configuration file template below to create a json file. After you have filled in the options with the appropriate values, pass the json file and apply settings with the following commands:

`tsm settings import -f path-to-file.json`

`tsm pending-changes apply`

If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case, there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behaviour. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/current/server-linux/en-gb/cli_pending-changes.htm#pending-changes-apply).

## Configuration template

Use this template to configure OpenID settings.

**Important:** All entity options are case sensitive.

For more explanation about configuration files, entities and keys see [Configuration File Example](https://help.tableau.com/current/server-linux/en-gb/config_file_example.htm).

After you have finished with the initial configuration of OIDC, use the [tsm authentication openid <commands>](https://help.tableau.com/current/server-linux/en-gb/cli_authentication_tsm.htm#TSMOIDC) sub-category to set additional values.

{
	"configEntities": {
	    "openIDSettings": {
		"\_type": "openIDSettingsType",
		"enabled": true,
		"clientId": "required",
		"clientSecret": "required",
		"configURL": "required if staticFile value is not set",
		"staticFile": "required if configURL value is not set",
		"externalURL": "required"
		}
	  }
}		

## Configuration file reference

The following list includes all of the options that can be included with the `"openIDSettings"` entity set.

\_type

Required.

Do not change.

enabled

Required.

Set to `true`.

clientId

Required.

Specifies the provider client ID that your IdP has assigned to your application. For example, `“laakjwdlnaoiloadjkwha"`.

clientSecret

Required.

Specifies the provider client secret. This is a token that is used by Tableau to verify the authenticity of the response from the IdP. This value is a secret and should be kept securely.

For example, `“fwahfkjaw72123="`.

configURL

Required.

Specifies provider configuration URL. If you do not specify a configuration URL, then delete this option and specify a path and file name for `staticFile` instead.

staticFile

Required.

Specifies the local path to the static OIDC discovery JSON document. If you do not specify a static file, then delete this option and specify a url for `configURL` instead.

externalURL

Required.

The URL of your server. This is typically is the public name of your server, such as `http://example.tableau.com`.

connectionTimeout

Optional.

Specifies connection timeout span in seconds. Default is `10`.

readTimeout

Optional.

Specifies read timeout span in seconds. Default is `30`.

ignoreDomain

Set this to `true` if the following are true:

- You are using email addresses as usernames in Tableau Server
- You have provisioned users in the IdP with multiple domain names
- You want to ignore the domain name portion of the `email` claim from the IdP

Before you proceed, review the user names that will be used as a result of setting this option to `true`. User name conflicts may occur. In the case of a user name conflict, the risk of information disclosure is high. See [Requirements for Using OpenID Connect](https://help.tableau.com/current/server-linux/en-gb/openid_auth_requirements.htm).

ignoreJWK

Set this to `true` if your IdP does not support JWK validation. In this case, we recommend authenticating communication with your IdP using mutual TLS or another network layer security protocol. Default is `false`.

customScope

Specifies a custom scope user-related value that you can use to query the IdP. See [Requirements for Using OpenID Connect](https://help.tableau.com/current/server-linux/en-gb/openid_auth_requirements.htm).

idClaim

Change this value if your IdP does not use the `sub`claim to uniquely identify users in the ID token. The IdP claim that you specify should contain a single, unique string.

usernameClaim

Change this value to the IdP claim that your organisation will use to match user names as stored in Tableau Server.

clientAuthentication

Specifies custom client authentication method for OpenID Connect.

To configure Tableau Server to use the Salesforce IdP, set this value to `client_secret_post`.

iFramedIDPEnabled

Set to `true` to allow IdP displayed in an iFrame. The IdP must disable clickjack protection to allow iFrame presentation.