--- schema_version: "1" id: 0664ea93169173d982d9a2a301d456024b6b17a08362d6dab260e376aadce90a title: Configure SAML with Salesforce IdP on Tableau Server collection: tableau version: current locale: en-gb portal_url: https://docs.salesforce.com/tableau/current/en-gb/server/saml_config_salesforce_server.md canonical_url: https://help.tableau.com/current/server/en-gb/saml_config_salesforce_server.htm source_site: help.tableau.com content_type: documentation content_hash: f2856348e99e85102d917820f8173c7879cb8dd6725d2957a89630a14a5b6605 description: Configure Salesforce as a SAML identity provider on Tableau Server. --- [Skip to main content](#main-content) # Configure SAML with Salesforce IdP on Tableau Server This topic provides road-map steps that describe how to configure SAML on Tableau Server with the Salesforce IdP. This topic also explains how to enable Lightning Web Component (LWC). The LWC allows Salesforce administrators to embed a Tableau visualisation within a Lightning page. When SSO is configured for Tableau Viz LWC on Tableau Server, the user experience is seamless: after the user signs into Salesforce, embedded Tableau views will work without further authentication to Tableau Server. ## Enable Salesforce as a SAML Identity Provider If you have not yet configured Salesforce as an IdP, then follow the procedure, [Enable Salesforce as a SAML Identity Provider](https://help.salesforce.com/articleView?id=sf.identity_provider_enable.htm&type=5), on the Salesforce Help site. During the process to enable Salesforce as a SAML IdP, you will either specify a certificate or Salesforce will generate a self-signed certificate for use with SAML. Download this certificate (.crt file) and the associated provider metadata file (.xml). You will need these assets in the next step. ## Configure SAML on Tableau Server Using the certificate and metadata files that you downloaded in the previous step, follow the procedure in [Configure Server-Wide SAML](https://help.tableau.com/current/server/en-gb/config_saml.htm). As part of the configuration process, you will generate a SAML Entity ID and a login URL for Tableau Server. You will need these assets for the next step. (Optional) After you have configured server-wide SAML, you can configure site-specific SAML on Tableau Server. See [Configure Site-Specific SAML](https://help.tableau.com/current/server/en-gb/saml_site_specific.htm). ## Add Tableau Server as an External Client App or Connected App in Salesforce To enable Tableau integration with Salesforce, you must first configure application integration in Salesforce. We strongly recommend using external client apps. If available, you can use Salesforce-connected apps. ### External client app (recommended) Follow the procedure described the [Integrate a SAML SSO Service Provider as an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.meta_external_client_app_saml.htm&type=5) topic in the Salesforce Help. ### Connected app (deprecated) > [!WARNING] > > **Important:** Starting in the Spring ’26 release of Salesforce, connected app creation is restricted. You can continue to use existing connected apps during and after Spring ’26 but using external client apps are strongly recommended. For more information, see the following in the Salesforce Help: [New connected apps can no longer be created in Spring ’26](https://help.salesforce.com/s/articleView?id=005228017), [Create an External Client App](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&type=5) and [Connected App to External Client App Migration.](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_to_external_client_app_migration.htm&type=5) Follow the procedure described in the [Integrate Service Providers as Connected Apps with SAML 2.0](https://help.salesforce.com/articleView?id=sf.connected_app_create_saml_sso.htm&type=5) topic in the Salesforce Help. In this process, you will create a new connected app (Tableau Server). Some important details follow: - Select "Enable SAML" - Enter the Entity ID and the login URL that you generated when configuring Tableau in the previous section. By default, login URL is `https:///wg/saml/SSO/index.html`. - For the IdP certificate, be sure to select the same certificate that you specified or generated when you enabled Salesforce as a SAML provider. - To allow users to sign in to Tableau Server from your org, manage access to your connected app by assigning the appropriate profiles or permission sets. ## Enable Lightning Web Component To enable LWC for SAML SSO on Tableau Server, you must enable in-frame authentication. Before you enable LWC, upgrade to the latest maintenance release of Tableau Server. Two additional version details are important: - If you are not running the latest maintenance release, and your users are running Chrome browsers to access Salesforce Lightning, then review the Tableau KB article, [Embedded Views Fail to Load After Updating to Chrome 80](https://kb.tableau.com/articles/issue/embedded-views-fail-to-load-after-updating-to-chrome-80?lang=en-gb). - If you are using LWC with site-specific SAML on Tableau Server, then you must be running the Tableau Server 2020.4 or later. After you have configured SAML on Tableau Server, run the following TSM commands to enable in-frame authentication: `tsm configuration set -k wgserver.saml.iframed_idp.enabled -v true` `tsm pending-changes apply` ## Embed Tableau Views into Salesforce After you have configured Tableau Server for SSO, you can then install the LWC in your Salesforce org and embed Tableau views. See [Embed Tableau Views into Salesforce](https://help.tableau.com/current/pro/desktop/en-gb/embed_ex_lwc.htm).