---
schema_version: "1"
id: d7be855cad6d9e938021bd22b1f167111a4b8e78377f7ea2957830784a16532c
title: Configure External OAuth for Impala
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/server-linux/config_oauth_impala.md
canonical_url: https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_impala.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 6596b0d2da7c9836a0a6136ef73f7bf409b986ee5e5ee4f8b461c8b53cdb0cad
description: Configure external OAuth 2.0/OIDC identity federation for Impala in Tableau.
---
[Skip to main content](#main-content)

# Configure External OAuth for Impala

Starting in Tableau 2025.3 for Tableau Desktop and Tableau Server, and 2026.1 for Tableau Cloud, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to Impala.

Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview.

## Configure IDP on Impala

For information on configuring your IdP on Impala, see [Configuring OAuth Authentication](https://docs.cloudera.com/cdp-private-cloud-base/7.1.9/impala-secure/topics/impala-oauth.html "Link to Cloudera docs for configuring OAuth on Impala") in the Cloudera documentation.

## Configure the IDP

1. Create OAuth clients on the IDP for Tableau Desktop, and Tableau Server or Tableau Cloud. The Tableau Desktopclient should enable `[PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)` and use `http://localhost` redirects.
2. Create the Tableau OAuth config files. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [GitHub](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth documentation on GitHub"), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth "OAuth examples on GitHub."). We welcome examples for other IDPs.
    
    1. Be sure to prefix the Tableau OAuth config IDs with "`custom_`".
        
        **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work.
    2. If your IDP supports dynamic localhost port then disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP.
3. Install the new Tableau OAuth configuration files in the `OAuthConfigs` folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth, via the site settings page. For more details, see [Custom OAuth Configs on Tableau Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients).

## Connect to Impala

The user must select Sign in using OAuth, and select the OAuth Provider installed earlier.

![](/tableau/next/en-us/server-linux/en-us/Img/impala_oauth_connect.png)