---
schema_version: "1"
id: f522f3c51d4017e479b214d36f47aa1bea20fb79fbe1dd737aa1c708f8325be4
title: Kerberos
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/server-linux/kerberos.md
canonical_url: https://help.tableau.com/v0.0/server-linux/en-us/kerberos.htm
source_site: help.tableau.com
content_type: documentation
content_hash: c4d6cc300d3e53d7d8b930947d1c00e884c43d3cc919551947e57646023e2b38
description: Understand Kerberos, a three-way authentication protocol used with Tableau Server.
---
[Skip to main content](#main-content)

# Kerberos

Kerberos is a three-way authentication protocol that relies on the use of a trusted third-party network service called the Key Distribution Center (KDC) to verify the identity of computers and provide for secure connections between the computers through the exchange of _tickets_. These tickets provide mutual authentication between computers or services, verifying that one has permission to access the other.

Tableau Server supports Kerberos authentication in an Active Directory Kerberos environment, with authentication to Tableau Server being handled by Kerberos.

**Notes**: 

- The Kerberos support in Tableau Server is for user authentication. It does not handle internal permissions and authorization related to Tableau Server content, such as workbooks.
- Identity pools, which is a tool designed to complement and support additional user provisioning and authentication options you might need in your organization, supports OpenID Connect (OIDC) authentication only. For more information, see [Provision and Authenticate Users Using Identity Pools](https://help.tableau.com/v0.0/server-linux/en-us/identity_pools.htm).

## How Kerberos works

When you configure Tableau Server for Kerberos in an Active Directory (AD) environment, the AD domain controller also serves as the Kerberos Key Distribution Center (KDC) and issues Ticket Granting Tickets to the other nodes in the domain. Users authenticated by the KDC do not have to authenticate further when connecting to Tableau Server.

The following is a diagram of the authentication workflow.

![A diagram illustrating the authentication process for a Tableau Server user.](/tableau/next/en-us/server-linux/en-us/Img/kerb_client_server.png)

<table>
                    <tbody>
                        <tr>
                            <td style="text-align: center;">
                                <img src="https://help.tableau.com/v0.0/server-linux/en-us/Img/1ball.png" alt="A blue circle with a white number 1 in the center.">
                            </td>
                            <td>User logs into their Active Directory domain.</td>
                            <td style="text-align: center;">
                                <img src="https://help.tableau.com/v0.0/server-linux/en-us/Img/2ball_32x32.png" style="width: 32;height: 32;" alt="A blue circle with a white number 2 in the center.">
                            </td>
                            <td>The Kerberos KDC authenticates the user and sends a Ticket Granting Ticket (TGT) to the user's computer.</td>
                        </tr>
                        <tr>
                            <td style="text-align: center;">
                                <img src="https://help.tableau.com/v0.0/server-linux/en-us/Img/3ball.png" alt="A blue circle with a white number 3 in the center.">
                            </td>
                            <td>The user connects to Tableau Server in <span class="mc-variable Variables.TabsProductDesktop variable">Tableau Desktop</span> or in a web browser.</td>
                            <td style="text-align: center;">
                                <img src="https://help.tableau.com/v0.0/server-linux/en-us/Img/4ball.png" alt="A blue circle with a white number 4 in the center.">
                            </td>
                            <td>
                                <p>Tableau Server authenticates the user.</p>
                            </td>
                        </tr>
                    </tbody>
                </table>

## Other articles in this section