--- schema_version: "1" id: 1128c9c06c2cec178f9a390b8e5f330b4a3e2a627cd337844929edb81fd9e8a6 title: Troubleshoot Connected Apps - Direct Trust collection: tableau version: next locale: en-gb portal_url: https://docs.salesforce.com/tableau/next/en-gb/server-linux/connected_apps_troubleshoot.md canonical_url: https://help.tableau.com/v0.0/server-linux/en-gb/connected_apps_troubleshoot.htm source_site: help.tableau.com content_type: documentation content_hash: fe74b8d113eae70ef7991db50622857184b7fce56196a9969437d5e62e5303aa description: Troubleshoot direct-trust connected apps when embedded content or REST API authorization fails. --- [Skip to main content](#main-content) # Troubleshoot Connected Apps - Direct Trust When embedded content fails to display in your custom application or Tableau REST API authorisation fails, you can use a browser’s developer tools to inspect and identify error codes that might be associated with the Tableau connected app that’s used to display the embedded content. **Note:** In order for the session token to be valid, the clocks of the external application and the server that hosts the external application must be set to Coordinated Universal Time (UTC). If either clock uses a different standard, the connected app will not be trusted. Refer to the table below to review the description of the error code and potential resolution.
Error codeSummaryDescriptionPotential resolution or explanation
5SYSTEM_USER_NOT_FOUNDTableau user could not be found To resolve this issue, verify the 'sub' (Subject) claim value in the JWT is 'username' for Tableau Server. This value is case sensitive.
16LOGIN_FAILEDLogin failedThis error is typically caused by one of the following claim issues in the JWT:
  • The 'exp' (Expiry Time) exceeds the default maximum validity period. To resolve this issue, review registered claims required for a valid JWT and ensure the correct value is used. To change the maximum validity period, you can use the vizportal.oauth.connected_apps.max_expiration_period_in_minutes command.
  • The 'sub' (Subject) is calling an unknown user. To resolve this issue, verify that the 'sub' claim is "username". This value is case sensitive.
67FEATURE_NOT_ENABLEDOn-demand access is not supportedOn-demand access is available through licensed Tableau Cloud sites only.
126CONNECTED_APP_NOT_FOUNDThe connected app could not be foundTo resolve this issue, verify that the connected app is enabled and the correct client ID (also known as the connect app ID) is referenced in the JWT.
127CONNECTED_APP_SECRET_NOT_FOUNDThe connected app's secret could not be foundTo resolve this issue, verify that the correct connected app's secret ID and secret value are referenced in the JWT.
128CONNECTED_APP_SECRET_LIMIT_EXCEEDEDMaximum limit for secrets has been reachedA maximum of two secrets are allowed for a connected app. This error can occur when there's an attempt to create a third secret.

To resolve this issue, delete a secret from the connected app before creating a new one.

133INVALID_CONNECTED_APP_DOMAIN_SAFELISTDomain allowlist contains one or more invalid charactersThis error can occur when the domain allowlist contains one or more invalid characters.
10083BAD_JWTJWT header contains issuesThe 'kid' (Secret ID) or 'clientId' (Issuer) claims are missing from the JWT header. To resolve this issue, ensure this information is included.
10084JWT_PARSE_ERRORJWT contains issuesTo resolve this issue, verify the following:
  • The ‘aud’ (Audience) value referenced in the JWT uses the ‘tableau’ value. This value is case sensitive.
  • The 'aud' (Audience) and 'sub' (Subject) are included in the JWT.
  • Review IssueTime or ensure there's no clock mismatch between the machine hosting the connected app and Tableau Cloud.
10085COULD_NOT_FETCH_JWT_KEYSJWT could not find keysCould not find the secret.

To resolve this issue, verify the correct 'kid' (Secret ID) is used in the JWT header.

10087BLOCKLISTED_JWS_ALGORITHM_USED_TO_SIGNIssue with the JWT signing algorithmTo resolve the issue, you can remove the signing algorithm. For more information, see vizportal.oauth.external_authorization_server.blocklisted_jws_algorithms.
10089CONNECTED_APP_NOT_FOUNDCould not find connected appTo resolve this issue, ensure the issuer is calling the correct connected app ID (also known as the client ID).
10090CONNECTED_APP_DISABLEDConnected app is disabledThe connected app used to verify trust is disabled. To resolve this issue, enable the connected app.
10091JTI_ALREADY_USEDUnique JWT requiredThe JWT has already been used in the authentication process. To resolve this issue, a new JWT must be generated.
10092NOT_IN_DOMAIN_ALLOW_LISTDomain of the embedded content is not specifiedTo resolve this issue, ensure the unrestrictedEmbedding setting is set to true or domainAllowlist parameter includes the domains where Tableau content is embedded using the Update Embedding Settings for Site method in the Tableau REST API.
10094MISSING_REQUIRED_JTIMissing JWT IDTo resolve this issue, verify the 'jti' (JWT ID) is included in the JWT.
10096JWT_EXPIRATION_EXCEEDS_CONFIGURED_EXPIRATION_PERIODIssue with expiry time The 'exp' (Expiry Time) exceeds the default maximum validity period. To resolve this issue, review registered claims required for a valid JWT and ensure the correct value is used. To change the maximum validity period, you can use the vizportal.oauth.external_authorization_server.max_expiration_period_in_minutes command.
10097SCOPES_MALFORMEDIssues with scopes claimThis error can occur when the 'scp' (Scope) claim is either missing from the JWT or not passed as a list type. To resolve this issue, verify 'scp' is included in the JWT and passed as a list type. For troubleshooting help with a JWT, see Debugger on the auth0 site.
10098JWT_UNSIGNED_OR_ENCRYPTEDJWT is unsigned or encryptedTableau does not support an unsigned or encrypted JWT.
10099SCOPES_MISSING_IN_JWTMissing scopes claimThe JWT is missing the required 'scp' (scope) claim. To resolve this issue, verify 'scp' is included in the JWT. For troubleshooting help with a JWT, see Debugger on the auth0 site.
10100JTI_PERSISTENCE_FAILEDUnexpected JWT ID errorThere was an unexpected 'jti' (JWT ID) error. To resolve this issue, a new JWT with a new 'jti' must be generated.
10103JWT_MAX_SIZE_EXCEEDEDJWT exceeds maximum sizeThis error can occur when JWT size exceeds 8000 bytes. To resolve this issue, make sure that only the necessary claims are being passed to Tableau Server.
10105ORIGIN_HEADER_NOT_A_VALID_URIInvalid Origin headerThis error can occur because 1) a URL is specified in the domain allowlist and 2) the Origin header does not contain a valid URL.
10106ORIGIN_HEADER_NOT_SETMissing Origin headerThis error can occur because 1) a URL is specified in the domain allowlist and 2) the Origin header is not set.