--- schema_version: "1" id: d54e839a676ec7b181d6aff735d151712ccc67fec5222a7b33b76b4bcfddc169 title: Tableau Client Support for Kerberos SSO collection: tableau version: current locale: en-us portal_url: https://docs.salesforce.com/tableau/current/en-us/server-linux/kerberos_browser.md canonical_url: https://help.tableau.com/current/server-linux/en-us/kerberos_browser.htm source_site: help.tableau.com content_type: documentation content_hash: 742fd8832b944e5e8a52e8d9ba9fbce1b21270bc073962090565abcd43ec9a2d description: Understand Tableau client and OS support for Kerberos single sign-on. --- [Skip to main content](#main-content) # Tableau Client Support for Kerberos SSO This article describes some requirements for and nuances with using Kerberos single sign-on (SSO) with Tableau Server, depending on the particular Tableau client and operating system. Tableau clients covered in this article include common web browsers, Tableau Desktop, and the Tableau Mobile app. ## General browser client support To use browser-based Kerberos Single Sign-on (SSO), the following must be true: - Kerberos must be enabled on Tableau Server. - The user must have a user name and password to sign in to Tableau Server. **Note:** When Kerberos SSO fails, users can fall back on their user name and password credentials, if a fall back is set up. - The user must be authenticated to Active Directory through Kerberos on the client computer or mobile device. Specifically, this means that they have a Kerberos Ticket Granting Ticket (TGT). ## Tableau Desktop and browser clients On Windows or the Mac, you can use Kerberos SSO to sign in to Tableau Server from the following versions of Tableau Desktop or browser. Where noted, additional configuration is required. Windows - Tableau Desktop 10.3 or later supported. - Internet Explorer - supported, may require configuration - see [Note 1](#note1) - Chrome - supported, may require configuration -see [Note 1](#note1) - Firefox - requires configuration - see [Note 2](#note2) - Safari - not supported Mac OS X - Tableau Desktop 10.3 or newer - Safari - supported - Chrome - see [Note 3](#note3) - Firefox - see [Note 2](#note2) - Internet Explorer - not supported ## Tableau Mobile app clients On a iOS or Andoid device, you can use the following Tableau Mobile or mobile browser versions to use Kerberos authentication to Tableau Server: iOS - Tableau Mobile app- see [Note 4](#note4) - Safari - see [Note 4](#note4) - Chrome - not supported Android - see [Note 5](#note5) - Tableau Mobile app - Chrome ## Operating system and browser-specific notes The following notes describe configuration requirements or issues with specific operating system and client combinations. ### Note 1: Internet Explorer or Chrome on Windows desktop Kerberos SSO is supported in both Internet Explorer and Chrome, but it requires configuration in Windows Internet Options: 1. Enable Integrated Windows Authentication. 2. Verify that Tableau Server URL is in the local intranet zone. Internet Explorer can sometimes detect intranet zones and configure this setting. If it has not detected and configured the Tableau Server URL, you must manually add the URL to the local intranet zone. To enable Integrated Windows Authentication: 1. In Windows Control Panel, open **Internet Options**. 2. On the **Advanced** tab scroll down to the **Security** section. 3. Select **Enable Integrated Windows Authentication**. 4. Click **Apply**. To verify or add the Tableau Server URL to the local intranet zone: 1. In Windows Control Panel, open **Internet Options**. 2. On the **Security** tab, select **Local intranet**, and then click **Sites**. 3. On the **Local intranet** dialog box, click **Advanced**. In the **Websites** field, look for the internal Tableau Server URL. In some organizations, IT administrators will use a wildcard (\*) to specify internal URLs. For example, the following URL includes all servers in the internal `example.lan` namespace in the local intranet zone: `https://*.example.lan` The following image shows a specific URL of `https://tableau.example.lan`. ![Local intranet dialog for adding or removing websites from a zone.](/tableau/current/en-us/server-linux/en-us/Img/kerberos_intranet_zone.png) 4. If the Tableau Server URL or a wildcard URL is not specified in the **Websites** field, enter the Tableau Server URL in the **Add the website to the zone** field, click **Add**, and then click **OK**. If the Tableau Server URL is already listed in Websites, you can simply close the dialog. ### Note 2: Firefox on Windows or Mac OS X desktop You can use Firefox with Kerberos SSO on either Windows or Mac to sign in to Tableau Server. To do this, you must complete the following steps to configure Firefox to support Kerberos: 1. In Firefox, enter `about:config` in the address bar. 2. Click **I'll be careful, I promise** when warned about changing advanced settings. 3. Enter `negotiate` in the Search box. ![Example Tableau Server config page in Firefox.](/tableau/current/en-us/server-linux/en-us/Img/kerberos_firefox.png) 4. Double-click **network.negotiate-auth.allow-non-fqdn**, and then set the value to **true**. 5. Double-click **network.negotiate-auth.trusted-uris** and enter the Tableau Server fully qualified domain name (FQDN). For example, `tableau.example.com`. ### Note 3: Chrome on Mac OS X desktop According to Chrome documentation, Kerberos SSO works on a Mac when you launch Chrome from a terminal window with the following command: `open -a "Google Chrome.app" --args --auth-server-whitelist="tableauserver.example.com"` where `tableauserver.example.com` is the URL for Tableau Server in your environment. However, we have found inconsistent results in our testing. Therefore, if you want to use Kerberos SSO on a Mac, we recommend that you use Safari or Firefox. For more information, see the _Integrated Authentication_ section at [HTTP authentication](http://www.chromium.org/developers/design-documents/http-authentication) on The Chromium Projects site. **Note**: Users can still use Chrome on Mac OS X to sign in to Tableau Server, but they might be prompted to enter their user name and password (single sign-on may not work). ### Note 4: Mobile Safari or Tableau Mobile on iOS Kerberos SSO is supported if iOS is configured for Kerberos. The iOS device must have a Kerberos authentication configuration profile installed. This is usually done by an enterprise IT group. Tableau Support cannot assist with configuring iOS devices for Kerberos. See the [authentication topic](https://help.tableau.com/current/mobile/mobile-admin/en-us/admin_mobile_sso.htm#kerberos-ios-and-tableau-server-only) in the _Tableau Mobile Deployment Guide_. ### Note 5: Android platform Kerberos SSO is not supported on the Tableau Mobile app on the Android operating system. You can still use your Android device and the Tableau Mobile app or a supported mobile browser to connect to Tableau Server if Kerberos has a fall back set up for when SSO fails to accept user name and password authentication. In this scenario, rather than authenticating with Kerberos, users will be prompted to enter their credentials when accessing Tableau Server. ### More information - _Tableau Mobile Deployment Guide_: [Control authentication and access for Tableau Mobile](https://help.tableau.com/current/mobile/mobile-admin/en-us/admin_mobile_sso.htm) - See _Web Browsers_ under [Tableau Server Tech Specs](https://www.tableau.com/products/techspecs#paragraph-id--211678)