Connect Tableau Server

✦TL;DR

Connect Atlan to Tableau Server - everything from the Cloud guide plus the two Server-only steps, enabling the Metadata API and getting SSL certificates right.

||

|Connect

Everything from the Cloud guide, plus the two Server-only steps that cause most Server issues: enabling the Metadata API and getting SSL certificates right.

Prerequisites

• Tableau Server 2022.x or later (REST API 3.14+) - see Set up Tableau.
• Someone with TSM (Tableau Services Manager) access on the server for Phase 1.
• The server reachable from the internet, or an allowlist / PrivateLink/agent plan if it isn't.

Five phases at glance

Phase	What happens	Owner	Typical time
1. Enable Metadata API	One TSM command + a one-off indexing wait	Tableau admin	10 min + up to hours of indexing
2. Service account & PAT	Dedicated user, Site Administrator Explorer, token	Tableau admin	15 minutes
3. Network reachability	Firewall opening for Atlan's IPs, if the server isn't public	Your network team + Atlan support	1 ticket + a firewall change
4. SSL certificate	Provide the full chain if you use a private/self-signed cert	Your network team	30 minutes
5. Configure & test	Enter values in Atlan, test, first crawl	Atlan User	20 minutes

Phase 1 - Enable Metadata API

Owner: Tableau admin

Off by default on Tableau Server. On the server, run:

tsm maintenance metadata-services enable

Atlan's preflight fails with exactly this hint if it's missing: "Cannot run the query because the Metadata API has not been enabled yet. Run the 'tsm maintenance metadata-services enable' command".

First enable (and every Tableau upgrade) triggers "backfill"

Tableau builds its lineage index by scanning all existing content - called backfill. Until it finishes (hours to up to a week on large servers, and it re-runs after quarterly Tableau upgrades), lineage queries return BACKFILL-RUNNING errors and crawls can fail. This is a wait, not a fault - schedule the first crawl after backfill completes.

Phase 2 - Create service account and PAT

Owner: Tableau admin

Identical to Cloud Phase 1: dedicated user (e.g. svc-atlan), site role Site Administrator Explorer, one PAT per Atlan workflow, name is case-sensitive, secret shown once. The 15-day-idle and max-lifetime expiry rules apply (Server admins can configure the maximum).

Phase 3 - Make server reachable

Owner: Your network team

• Server already public? Nothing to do here.
• Behind a firewall? Get your tenant's NAT IPs (Atlan Network Details) and open inbound HTTPS from those IPs to the Tableau host and port - see the allowlist guide.
• Behind a WAF or inspection proxy? Tell the WAF team Atlan will POST GraphQL to /api/metadata/graphql and JSON to /api/<version>/… - WAF content rules have blocked exactly these calls before. See Allowlists, firewalls & WAFs.
• No inbound access possible? Use PrivateLink (AWS) or the self-deployed agent instead.

Phase 4 - Get SSL certificate right

Owner: Your network team

SSL certificate problems are the #2 Tableau Server failure theme. Two distinct situations:

A. Publicly trusted certificate (bought from a public CA)

Usually nothing to do - but your server must present the full chain (leaf + intermediates), not just its own certificate. Verify from any machine that can reach the server:

openssl s_client -connect tableau.example-corp.com:443 -showcerts </dev/null \
  | grep 's:\|i:'
# Healthy: 2+ certificates listed (leaf, then intermediate(s)).
# Only 1 = your server serves an incomplete chain -> browsers may still work
# (they cache intermediates) but Atlan will fail verification.

Incomplete chain? Fix it on the server: in Tableau Server's TSM SSL settings, provide the certificate chain file alongside the certificate - don't leave it empty.

B. Private-CA or self-signed certificate

Paste the chain into Atlan's SSL certificate field (Phase 5), as one PEM block in this order:

-----BEGIN CERTIFICATE-----
(1) your server's certificate - the "leaf"
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(2) intermediate CA certificate(s), in order
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(3) your root CA certificate
-----END CERTIFICATE-----

Certificates rotate - connections don't know

When your server's certificate is renewed or the load balancer's cert changes, a working Atlan connection starts failing with CERTIFICATE_VERIFY_FAILED. Add "update the Atlan SSL certificate field" to your certificate-rotation runbook.

Phase 5 - Configure and test in Atlan

Owner: Atlan User

1. New workflow → Tableau Assets, extraction method Direct.
2. Host Name: the server hostname only - no https://, no path. Port: 443 or your custom port.
3. Site: your site name (case-sensitive). Using Tableau Server's Default site → leave it blank.
4. SSL: enabled; paste the PEM chain from Phase 4B if you have a private/self-signed cert.
5. Test Authentication (as an Atlan admin - see the credential-save warning in the Cloud guide), then run preflight.

Success checklist

• Test Authentication passes
• Preflight passes - including the Metadata API check
• A crawl scoped to one small project completes
• A full crawl completes and lineage appears (first real exercise of the Metadata API at scale)

Next steps

Crawl Tableau: Configure and run the crawler to extract metadata from Tableau