---
schema_version: "1"
id: 6d510e304ef524e7789a2a181d42b9cda48ec6a854d4aa6f991b8c37bb24c5be
title: Signing In to Tableau Server Using OpenID Connect
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/server-linux/openid_auth_signing_in.md
canonical_url: https://help.tableau.com/current/server-linux/en-us/openid_auth_signing_in.htm
source_site: help.tableau.com
content_type: documentation
content_hash: ca6d71545d2bed6133837e3987a879a95920e494da1b586f9c3ca5f2744e02ee
description: Understand how users sign in to Tableau Server using OpenID Connect.
---
[Skip to main content](#main-content)

# Signing In to Tableau Server Using OpenID Connect

This topic provides information about signing in to Tableau Server using OpenID Connect. The following topics provide information about configuring and using OpenID Connect with Tableau Server.

- [OpenID Connect](https://help.tableau.com/current/server-linux/en-us/openid_auth.htm)
- [Configure the Identity Provider for OpenID Connect](https://help.tableau.com/current/server-linux/en-us/openid_auth_idp_config.htm)
- [Configure Tableau Server for OpenID Connect](https://help.tableau.com/current/server-linux/en-us/openid_auth_server_config.htm)
- Signing In to Tableau Server Using OpenID Connect (you are here)

## Signing in using OpenID Connect

After Tableau Server has been configured to use OpenID Connect, users who access the server and aren't already signed in are redirected to the IdP site, where they are prompted to sign in. Users enter the credentials that they have with the IdP. In many cases, the user is also asked to authorize the IdP to share information with Tableau Server, as in the following example:

![Google form to allow or deny access.](/tableau/current/en-us/server-linux/en-us/Img/Google-grant-access-db.png)

When a user signs in using OpenID Connect, the IdP sends a unique user identifier (known in OpenID as the sub value) as part of the information that's redirected to Tableau Server. This sub value is associated with the user's Tableau user identity.

## Restricting sign-in to server administrators for command-line tools

Command-line tools for working with Tableau Server (`tabcmd`, TSM, and `tableau.com`) do not support sign-in using OpenID Connect. When OpenID Connect is enabled for the server, these tools still require sign-in using a Tableau Server username and password.

Even if users normally authenticate using OpenID Connect, each user has a Tableau Server username and password. This means that users could use command-line tools like `tabcmd`. As a security measure, you can make sure that _only_ server administrators can use command-line tools. To do this, use `tsm configuration set` to set `wgserver.authentication.restricted` to `true`. When this setting is `true`, only server administrators can sign in to Tableau Server using a username and password; all other users _must_ sign in to the server using a single sign-on (SSO) option like OpenID Connect. The effect is that users who are not administrators also cannot then use command-line tools. To make this change, run the following sequence of TSM commands:

tsm configuration set -k wgserver.authentication.restricted -v true

tsm pending-changes apply