## Connect Tableau Server

URL: https://docs.atlan.com/apps/connectors/business-intelligence/tableau/how-tos/connect-tableau-server

> Connect Atlan to Tableau Server - everything from the Cloud guide plus the two Server-only steps, enabling the Metadata API and getting SSL certificates right.

Everything from the [Cloud guide](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-cloud/llms.txt), plus the two Server-only steps that cause most Server issues: enabling the Metadata API and getting SSL certificates right.

## Prerequisites

- Tableau Server **2022.x or later** (REST API 3.14+) - see [Set up Tableau](https://docs.atlan.com/llms/connectors/tableau/set-up-tableau/llms.txt).
- Someone with **TSM (Tableau Services Manager) access** on the server for Phase 1.
- The server reachable from the internet, or an [allowlist](https://docs.atlan.com/llms/connectors/tableau/allowlists-firewalls-and-wafs/llms.txt) / [PrivateLink/agent](https://docs.atlan.com/llms/connectors/tableau/special-cases/llms.txt) plan if it isn't.

## Five phases at glance

| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Enable Metadata API | One TSM command + a one-off indexing wait | Tableau admin | 10 min + up to hours of indexing |
| 2. Service account & PAT | Dedicated user, Site Administrator Explorer, token | Tableau admin | 15 minutes |
| 3. Network reachability | Firewall opening for Atlan's IPs, if the server isn't public | Your network team + Atlan support | 1 ticket + a firewall change |
| 4. SSL certificate | Provide the full chain if you use a private/self-signed cert | Your network team | 30 minutes |
| 5. Configure & test | Enter values in Atlan, test, first crawl | Atlan User | 20 minutes |

## Phase 1 - Enable Metadata API

**Owner:** Tableau admin

Off by default on Tableau Server. On the server, run:

```
tsm maintenance metadata-services enable
```

Atlan's preflight fails with exactly this hint if it's missing: *"Cannot run the query because the Metadata API has not been enabled yet. Run the 'tsm maintenance metadata-services enable' command"*.

:::info First enable (and every Tableau upgrade) triggers "backfill"

Tableau builds its lineage index by scanning all existing content - called **backfill**. Until it finishes (hours to *up to a week* on large servers, and it re-runs after quarterly Tableau upgrades), lineage queries return `BACKFILL-RUNNING` errors and crawls can fail. This is a wait, not a fault - schedule the first crawl after backfill completes.

:::

## Phase 2 - Create service account and PAT

**Owner:** Tableau admin

Identical to [Cloud Phase 1](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-cloud/llms.txt): dedicated user (e.g. `svc-atlan`), site role **Site Administrator Explorer**, one PAT per Atlan workflow, name is case-sensitive, secret shown once. The 15-day-idle and max-lifetime expiry rules apply (Server admins can configure the maximum).

## Phase 3 - Make server reachable

**Owner:** Your network team

- **Server already public?** Nothing to do here.
- **Behind a firewall?** Get your tenant's NAT IPs ([Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt)) and open inbound HTTPS from those IPs to the Tableau host and port - see the [allowlist guide](https://docs.atlan.com/llms/connectors/tableau/allowlists-firewalls-and-wafs/llms.txt).
- **Behind a WAF or inspection proxy?** Tell the WAF team Atlan will POST GraphQL to `/api/metadata/graphql` and JSON to `/api/<version>/…` - WAF content rules have blocked exactly these calls before. See [Allowlists, firewalls & WAFs](https://docs.atlan.com/llms/connectors/tableau/allowlists-firewalls-and-wafs/llms.txt).
- **No inbound access possible?** Use [PrivateLink (AWS) or the self-deployed agent](https://docs.atlan.com/llms/connectors/tableau/special-cases/llms.txt) instead.

## Phase 4 - Get SSL certificate right

**Owner:** Your network team

SSL certificate problems are the **#2 Tableau Server failure theme**. Two distinct situations:

### A. Publicly trusted certificate (bought from a public CA)

Usually nothing to do - but your server must present the **full chain** (leaf + intermediates), not just its own certificate. Verify from any machine that can reach the server:

```
openssl s_client -connect tableau.example-corp.com:443 -showcerts </dev/null \
 | grep 's:\|i:'

# Healthy: 2+ certificates listed (leaf, then intermediate(s)).

# Only 1 = your server serves an incomplete chain -> browsers may still work

# (they cache intermediates) but Atlan will fail verification.

```

Incomplete chain? Fix it on the server: in Tableau Server's TSM SSL settings, provide the **certificate chain file** alongside the certificate - don't leave it empty.

### B. Private-CA or self-signed certificate

Paste the chain into Atlan's **SSL certificate** field (Phase 5), as one PEM block in this order:

```
-----BEGIN CERTIFICATE-----
(1) your server's certificate - the "leaf"
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(2) intermediate CA certificate(s), in order
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(3) your root CA certificate
-----END CERTIFICATE-----
```

:::caution Certificates rotate - connections don't know

When your server's certificate is renewed or the load balancer's cert changes, a working Atlan connection starts failing with `CERTIFICATE_VERIFY_FAILED`. Add "update the Atlan SSL certificate field" to your certificate-rotation runbook.

:::

## Phase 5 - Configure and test in Atlan

**Owner:** Atlan User

1. **New workflow → Tableau Assets**, extraction method **Direct**.
2. **Host Name**: the server hostname only - no `https://`, no path. **Port**: `443` or your custom port.
3. **Site**: your site name (case-sensitive). Using Tableau Server's *Default* site → leave it **blank**.
4. **SSL**: enabled; paste the PEM chain from Phase 4B if you have a private/self-signed cert.
5. **Test Authentication** (as an Atlan admin - see the credential-save warning in the [Cloud guide](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-cloud/llms.txt)), then run preflight.

### Success checklist

- **Test Authentication** passes
- Preflight passes - including the Metadata API check
- A crawl scoped to one small project completes
- A full crawl completes and lineage appears (first real exercise of the Metadata API at scale)

## Next steps

[Crawl Tableau](https://docs.atlan.com/llms/connectors/tableau/crawl-tableau/llms.txt): Configure and run the crawler to extract metadata from Tableau

---