--- schema_version: "1" id: 1e49c27836ee3f9e2ce1702ba3f11e2af8978d12502000e645a820bd59ce90fc title: Local Authentication collection: tableau version: current locale: en-gb portal_url: https://docs.salesforce.com/tableau/current/en-gb/server/local_auth.md canonical_url: https://help.tableau.com/current/server/en-gb/local_auth.htm source_site: help.tableau.com content_type: documentation content_hash: 7f1be301ea5f98f7965ae8147113f3e135b99509843f20debc6e6cecad779ed8 description: Configure local authentication and password settings for Tableau Server. --- [Skip to main content](#main-content) # Local Authentication If the server is configured to use local identity store, then Tableau Server authenticates users. When users sign-in and enter their credentials, either through Tableau Desktop, tabcmd, API or web client, Tableau Server verifies the credentials. Tableau user names stored in the identity store are associated with rights and permissions for Tableau Server. After authentication is verified, Tableau Server manages user access (authorisation) for Tableau resources. To use local authentication, you must configure Tableau Server with a local identity store during Setup. You cannot use local authentication if your Tableau Server has been configured with an external identity store (LDAP, Active Directory, etc). **Note:** Identity pools, which is a tool designed to complement and support additional user provisioning and authentication options you might need in your organisation, supports OpenID Connect (OIDC) authentication only. For more information, see [Provision and Authenticate Users Using Identity Pools](https://help.tableau.com/current/server/en-gb/identity_pools.htm). ## Password storage When local authentication is used, the user’s salted and hashed password is stored in the repository. Passwords are never stored directly, rather, the result of salting and hashing the password is stored. Server uses the PBKDF2 derivation function with the HMAC SHA512 hashing function. ## Configure password settings After you install Tableau Server with local authentication, you can use Tableau Server Manager (TSM) to configure a number of password-related settings: - Password policies: these policies define the requirement for password structure, such as length, character types and other requirements. - Password expiration: enable and specify password expiry. - Login rate limit: Tableau Server throttles the time between sign-in attempts after users enter 5 incorrect passwords. Users will need to wait a few seconds before attempting another sign-in. If users continue to enter incorrect passwords, then they must wait for exponentially longer periods of time in between sign-in attempts. By default, the maximum time between sign-in attempts is 60 minutes. Lock out account access after too many failed attempts. You can specify how many failed attempts users are allowed to enter before they are locked out. For information on how to unlock access to a locked account, see [View and manage users on a site](https://help.tableau.com/current/server/en-gb/users_view.htm#ViewEditSiteUser). - User password reset: Enable users to reset passwords. Enabling password reset will configure Tableau Server to display a link on the sign-in page. Users who forget passwords or want to reset a password can click the link to initiate a reset-password workflow. Password reset must be configured using TSM CLI, as described below. 1. Open TSM in a browser as a server administrator: https://:8850. For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/current/server/en-gb/sign_in_tsm.htm). 2. Click on User Identity & Access on the Configuration tab and then click Authentication Method. 3. Select Local authentication from the drop-down menu to display the password settings. 4. Configure the password settings and then click Save Pending Changes. 5. Click Pending Changes at the top of the page: ![Tableau Server Manager toolbar indicating that there are pending changes.](/tableau/current/en-gb/server/en-gb/Img/tsm-ui-pending-changes-btn.png) 6. Click Apply Changes and Restart. For the initial configuration of password policies, we recommend that you use the configuration file template below to create a json file. You can also set any single configuration key listed below with the syntax described in [tsm configuration set](https://help.tableau.com/current/server/en-gb/cli_configuration_tsm.htm#TSMSet). 1. Copy the following json template to a file. Fill in the key values with your password policy configuration. See the reference section that follows for more information about key options. { "configKeys": { "wgserver.localauth.policies.mustcontainletters.enabled": `false`, "wgserver.localauth.policies.mustcontainuppercase.enabled": `false`, "wgserver.localauth.policies.mustcontainnumbers.enabled": `false`, "wgserver.localauth.policies.mustcontainsymbols.enabled": `false`, "wgserver.localauth.policies.minimumpasswordlength.enabled": `false`, "wgserver.localauth.policies.minimumpasswordlength.value": `8`, "wgserver.localauth.policies.maximumpasswordlength.enabled": `false`, "wgserver.localauth.policies.maximumpasswordlength.value": `255`, "wgserver.localauth.passwordexpiration.enabled": `false`, "wgserver.localauth.passwordexpiration.days": `90`, "wgserver.localauth.ratelimiting.maxbackoff.minutes": `60`, "wgserver.localauth.ratelimiting.maxattempts.enabled": `false`, "wgserver.localauth.ratelimiting.maxattempts.value": _5_, "vizportal.password\_reset": `false` } } 2. Run the `tsm settings import -f file.json` to pass the json file with the appropriate values to Tableau Services Manager to configure Tableau Server. 3. Run the `tsm pending-changes apply` command to apply the changes. See [tsm pending-changes apply](https://help.tableau.com/current/server/en-gb/cli_pending-changes.htm#pending-changes-apply). ### Configuration file reference This section lists all of the options that can be used to configure password polices. wgserver.localauth.policies.mustcontainletters.enabled Default value: `false` Require at least one letter in passwords. wgserver.localauth.policies.mustcontainuppercase.enabled Default value: `false` Require at least one upper-case letter in passwords. wgserver.localauth.policies.mustcontainnumbers.enabled Default value: `false` Require at least one number letter in passwords. wgserver.localauth.policies.mustcontainsymbols.enabled Default value: `false` Require at least one special character in passwords. wgserver.localauth.policies.minimumpasswordlength.enabled Default value: `false` Enforce minimum-length passwords. wgserver.localauth.policies.minimumpasswordlength.value Default value: `8` The minimum number of characters passwords must have. Enter a value between `4` and `255`, inclusive. You must set `wgserver.localauth.policies.minimumpasswordlength.enabled` to `true` to enforce this value. wgserver.localauth.policies.maximumpasswordlength.enabled Default value: `false` Enforce maximum-length passwords. wgserver.localauth.policies.maximumpasswordlength.value Default value: `255` The maximum number of characters passwords may have. Enter a value between `8` and `225`, inclusive. You must set `wgserver.localauth.policies.maximumpasswordlength.enabled` to `true` to enforce this value. wgserver.localauth.passwordexpiration.enabled Default value: `false` Enforce password expiry. wgserver.localauth.passwordexpiration.days Default value: `90` The number of days before a password expires. Enter a value between `1` and `365`, inclusive. You must set `wgserver.localauth.passwordexpiration.enabled` to `true` to enforce this value. wgserver.localauth.ratelimiting.maxbackoff.minutes Default value: `60` Maximum time between sign-in attempts after a user enters multiple incorrect passwords. Enter a value between `5` and `1440`, inclusive. wgserver.localauth.ratelimiting.maxattempts.enabled Default value: `false` Enforce account lock out after 5 incorrect passwords are entered. To change the number of incorrect passwords that will trigger account lock out, you set `wgserver.localauth.ratelimiting.maxattempts.value`. wgserver.localauth.ratelimiting.maxattempts.value Default value: `5` The number of incorrect passwords that a user may enter to trigger account lock out. Enter a value between `5` and `100`, inclusive. You must set `wgserver.localauth.ratelimiting.maxattempts.enabled` to `true` to enforce this value. vizportal.password\_reset Default value: `false` Enable users to reset passwords. Tableau Server must be configured to send email for this feature to operate. See [Configure SMTP Setup](https://help.tableau.com/current/server/en-gb/config_smtp.htm).