Please use the form below to provide your feedback. Because your feedback is valuable to us, the information you submit in this form is recorded in our issue tracking system (JIRA), which is publicly available. You can track the status of your feedback using the ticket number displayed in the dialog once you submit the form.

Configure the Connection

  • how-to
Set up a connection between Tableau and Operational Insights Enterprise using the Couchbase Tableau Connector.

Set Up the Connection

To connect Tableau to your Couchbase cluster:

  1. Open Tableau Desktop.

  2. Go to Connect  To a Server  More.

  3. Select a Couchbase Tableau Connector. If there are multiple connectors installed, select the one that is compatible with your Couchbase product.

  4. In the connection dialog, enter the following details:

    Server

    Enter the server host details (host:port).

    To connect directly to a node, specify port 8095. If you select Require SSL, specify port 18095 instead.

    If you connect through a load balancer, you can omit the port. The connector then uses port 80, or port 443 if you select Require SSL.
    Scope

    (Optional) The scope to extract data from. You can leave this field blank or use Default if your data is in the default scope.
    Authentication

    The authentication method to use for the connection.

    Based on the authentication method you select, the required fields differ.

    Authentication Method Required Fields Description

    Username and Password

    Username, Password

    Enter user credentials.

    LDAP

    Username, Password

    Enter LDAP credentials.

    Client Certificate

    No fields appear in the dialog. You must configure client certificate properties in the couchbase-operational-insights.properties file. For more information, see Configure SSL Certificates.

    OAuth 2.0

    OAuth Provider

    Select the OAuth provider from the list. The list contains the default Keycloak configuration and any custom configurations you created. For more information, see Create a Custom Configuration File.

    To use OAuth 2.0 authentication, you need:

    • Enterprise Analytics 2.2 or later, or Operational Insights Enterprise 3.0 or later

    • An Identity Provider (IdP)

    • A custom XML configuration file

    For more information, see OAuth 2.0 Authentication.

  5. (Optional) Select the Require SSL option, if required.

    You must select Require SSL when using Client Certificate authentication. If you do not select this option, the connector connects without TLS and does not send the client certificate, causing the sign-in to fail with an authentication error. For more information about configuring certificates, see Configure SSL Certificates.

  6. For advanced settings, click the Advanced tab. You can set the connection timeout and scan consistency mode. If you set the scan consistency to Request plus, a dropdown appears to select the scan wait time.

  7. Click Sign In.

OAuth 2.0 Authentication

You can use OAuth 2.0 authentication to connect the Tableau Connector.

This authentication method uses an external Identity Provider (IdP) to issue a JSON Web Token (JWT). When you initiate a connection, the Tableau Connector opens a browser window for you to log in to the IdP. After you log in, the connector retrieves the access token and passes it to the JDBC driver to authenticate your connection.

Tableau manages token refreshing automatically, so you do not need to manually refresh the token.

To use OAuth 2.0 authentication, you need to:

  1. Get the required IdP details

  2. Create a custom XML configuration file with those IdP details

Get IdP Details

The following table lists the IdP details you need to set up OAuth 2.0 authentication.

Item Description

Identity Provider (IdP)

An OIDC-compliant IdP must be running and accessible from Tableau.

For example:

Issuer URL

The base OIDC discovery URL of your IdP realm.
For example: http://192.168.88.4:8080/realms/cb

Public Client ID

A public OIDC client registered on your IdP that:

  • Does not use a client secret.

  • Allows the redirect URIs used by Tableau.

Scopes

The registered client must have at least the following scopes enabled:

  • openid

  • offline_access (required for token refresh)

You can add additional scopes as well.

User Account

A valid user account on the IdP. The same user must be registered as an external user on Couchbase.

Once you’ve established these details, create a custom configuration file.

Create a Custom Configuration File

To connect Tableau to your IdP, you must provide your client ID, authentication endpoints, and other IdP settings. You can provide this information in a custom XML configuration file.

Once you add the file to the correct location, Tableau automatically loads it and displays your IdP in the authentication dropdown (see Set Up the Connection).

The Tableau Connector ZIP archive includes pre-filled templates for Keycloak, Okta, Azure AD and AuthO in the OAuthConfigs-templates/ directory. You can use these templates to create your own custom configuration file.

The Tableau Connector (.taco) file includes a default Keycloak configuration (displayed as Keycloak in the authentication dropdown), but with an empty client ID. To use it, you must provide your own client ID.

Configure the XML File

Open a template file in a text editor and update the attributes using the following rules:

If you do not follow these exactly, Tableau silently ignores the file and your configuration options do not appear in the connection dialog.

  • Set the plugin class: Set dbclass to couchbase-operational-insights. This links the configuration to the correct connector and must match the exact plugin class of your .taco file.

  • Prefix the configuration ID: The oauthConfigId attribute must start with custom_. For example, custom_myidp.

  • Format redirect URIs: Use a separate <redirectUrisDesktop> element for each redirect URI. Do not combine multiple URIs in a single element.

  • Use absolute URLs: Provide full, absolute URLs for the authUri and tokenUri elements. Tableau does not support OIDC discovery in override files.

    For information about these endpoints, see your IdP documentation.

The following is an example of a complete XML file for a custom IdP.

<?xml version="1.0" encoding="utf-8"?>
<pluginOAuthConfig>
    <dbclass>couchbase-operational-insights</dbclass>
    <oauthConfigId>custom_myidp</oauthConfigId>
    <configLabel>My IdP (my org)</configLabel>
    <clientIdDesktop>YOUR_CLIENT_ID</clientIdDesktop>
    <redirectUrisDesktop>http://localhost:55555/Callback</redirectUrisDesktop>
    <redirectUrisDesktop>http://localhost:55556/Callback</redirectUrisDesktop>
    <redirectUrisDesktop>http://localhost:55557/Callback</redirectUrisDesktop>
    <redirectUrisDesktop>http://localhost:55558/Callback</redirectUrisDesktop>
    <redirectUrisDesktop>http://localhost:55559/Callback</redirectUrisDesktop>
    <authUri>https://YOUR_IDP_HOST/oauth2/authorize</authUri>
    <tokenUri>https://YOUR_IDP_HOST/oauth2/token</tokenUri>
    <scopes>openid</scopes>
    <scopes>offline_access</scopes>
    <capabilities>
        <entry><key>OAUTH_CAP_REQUIRE_PKCE</key><value>true</value></entry>
        <entry><key>OAUTH_CAP_PKCE_REQUIRES_CODE_CHALLENGE_METHOD</key><value>true</value></entry>
        <entry><key>OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL</key><value>true</value></entry>
        <entry><key>OAUTH_CAP_SUPPORTS_GET_USERINFO_FROM_ID_TOKEN</key><value>true</value></entry>
    </capabilities>
    <accessTokenResponseMaps>
        <entry><key>ACCESSTOKEN</key><value>access_token</value></entry>
        <entry><key>REFRESHTOKEN</key><value>refresh_token</value></entry>
        <entry><key>access-token-expires-in</key><value>expires_in</value></entry>
        <entry><key>id-token</key><value>id_token</value></entry>
    </accessTokenResponseMaps>
    <refreshTokenResponseMaps>
        <entry><key>ACCESSTOKEN</key><value>access_token</value></entry>
        <entry><key>REFRESHTOKEN</key><value>refresh_token</value></entry>
        <entry><key>access-token-expires-in</key><value>expires_in</value></entry>
        <entry><key>id-token</key><value>id_token</value></entry>
    </refreshTokenResponseMaps>
</pluginOAuthConfig>

For more information about the XML, see Tableau OAuth Configuration and Usage.

Save the XML File

Name your XML file (for example, operational-insights-okta.xml) and save it in one of the following locations.

  • Windows: %USERPROFILE%\Documents\My Tableau Repository\OAuthConfigs\

  • macOS: ~/Documents/My Tableau Repository/OAuthConfigs/

After you save the XML file, restart Tableau. Tableau loads all .xml files from these directories on startup. When you open the connection dialog, your custom IdP configuration appears in the authentication dropdown.

Connect Tableau Desktop to Tableau Server

You can publish reports and dashboards created on Tableau Desktop to Tableau Server.

To configure your Tableau Server connection:

  1. In Tableau Desktop, go to Server  Tableau Online.

  2. Sign in with your Tableau Server credentials.

After you sign in, the connection appears in the Server section.

If you’re using an on-premise instance of Tableau Server, you need to configure SSL. You can do this by logging into the Tableau Services Manager UI and going to Configuration  Security  External SSL.

For more information about configuring SSL on your Tableau Server, see Configuring SSL on Tableau Server.