---
schema_version: "1"
id: eeda25e7b363ded03b2a8bcd7c4f6a94a981260aff0e459aa0f79056562d37a5
title: Configure External OAuth for SAP HANA
collection: tableau
version: next
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/next/en-gb/online/config_oauth_hana.md
canonical_url: https://help.tableau.com/v0.0/online/en-gb/config_oauth_hana.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 447e1e60a94d0a01688e12fcad793696fcdd8dfa1974cfe093d218937f130039
description: Configure external OAuth 2.0/OIDC identity federation for SAP HANA in Tableau Cloud.
---
[Skip to main content](#main-content)

# Configure External OAuth for SAP HANA

Starting in Tableau 2024.3 for Tableau Cloud, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to HANA.

Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview.

**Note**: Single use refresh tokens (sometimes called rolling refresh tokens or refresh token rotation) are not supported for OAuth connections using Tableau Bridge to Tableau Cloud. Support for these tokens are planned for a future release.

## Configure IDP on HANA

For information on configuring your IdP on HANA, see [Single Sign-On Using JSON Web Tokens](https://help.sap.com/docs/hana-cloud-database/sap-hana-cloud-sap-hana-database-security-guide/single-sign-on-using-json-web-tokens) in the SAP help system.

Here are some examples of different ways to set up IdP:

- Okta IdP using HANA Cockpit: [Connect to SAP HANA Cloud With Okta Account](https://help.alteryx.com/current/en/designer/data-sources/sap-hana/connect-to-sap-hana-cloud-with-okta-account.html#connect-to-sap-hana-cloud-with-okta-account)
- Azure IdP using HANA Studio: [Setting Up an SAP HANA Instance with OAuth or SSO](https://www2.microstrategy.com/producthelp/Current/Gateway_Connections/WebHelp/Lang_1033/Content/sap_hana_instance_oauth_sso.htm)

## Configure the IDP

1. Create OAuth clients on the IDP for Tableau Desktop, and Tableau Server or Tableau Cloud. The Desktop client should enable [`PKCE`](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)and use `http://localhost` redirects.
2. Create the Tableau OAuth config files. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [GitHub](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth documentation on GitHub"), as well as examples [here](https://github.com/tableau/en-gb/connector-plugin-sdk/tree/master/samples/components/oauth "OAuth examples on GitHub."). We welcome examples for other IDPs.
    
    1. Be sure to prefix the Tableau OAuth config IDs with “`custom_`”.
        
        **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but they will not work.
    2. If your IDP supports dynamic localhost port then disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP.
3. Install the new Tableau OAuth configuration files in the `OAuthConfigs` folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth, via the site settings page. For more details, see [Custom OAuth Configs on Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site-Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients).

## Connect to HANA

The user must select Sign in using OAuth, and select the OAuth Provider installed earlier.

![](/tableau/next/en-gb/online/en-gb/Img/hana_connect.png)

## Okta

If using Okta it’s better to use a “custom authorisation server” rather than the “org authorisation server”. The custom authorisation servers are more flexible. There is a custom authorisation server created by default, which is called “default”. The authorisation URL should look like this:

https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize

![](/tableau/next/en-gb/online/en-gb/Img/redshift_oauth_iam_okta_800x332.png)