Common Issues and Errors Associated with Trusted Tickets

Before you begin, review some of the terms that are used in this article:

• program code: The code that you have written, which creates the trust relationship/session.
• client_ip: The remote client IP address of the requesting browser session. This is the end users' session. This is not the IP address of your external web application.

Note: Trusted tickets are only valid for a single session to a single view. You cannot use trusted tickets authentication to redirect the end user to the general Tableau Server navigation interface; this is not allowed.

-1

We return -1 for the ticket if we refuse to issue the ticket. Some causes for this include: 1. Not trusting the IP address, and 2. The user specified in the program code does not exist in Tableau Server.

This may occur when the IP address list in Tableau Server has more than 1 IP address and the format is incorrect.

Please make sure the format is:

tabadmin set wgserver.trusted_hosts"{IP Address 1}, {IP Address 2}"

The space after the comma is required.

HTTP 401 - not authorized

This can occur because you have installed Tableau Server using active directory (AD) with automatic login (SSPI) enabled. To resolve this error, disable automatic login. To disable automatic login, click Start, select All Programs > Tableau Server > Configure Tableau Server. In the Tableau Server Configuration dialog box, clear the Enable Automatic Login check box.  

Alternatively, follow the steps in the Modifying Tableau Server Authentication Method article to use local authentication instead.

HTTP 404 - file not found

This can occur if your program code is referencing a Tableau Server URL that does not exist

Invalid user: username

This can occur if your program code is referencing a Tableau Server username, but you have not yet data entered that user name into Tableau. All trusted tickets requests must reference a valid, licensed username

Attempting to retrieve ticket from the wrong ip address: client_ip:xxx.xxx.xxx.xxx != remote_ip: xxx.xxx.xxx.xxx

Note: references to the phrase "client_ip" refer to the remote client IP address of the requesting browser session. This is the end user! This is not the IP address of your external web application!

This occurs if the originating ticket request came from a different IP address than the subsequent URL request. Your program code needs to accurately reflect the IP address of the remote web application. All URL requests sent via your remote web application need to match the ensuing Tableau Server URL request. Tableau does provide a tabadmin setting to override this; however, we do not recommend changing this setting as it can result in a security hole whereby a session could in theory be hijacked midstream. The setting to change is:
tabadmin set wgserver.extended_trusted_ip_checking false

Intermittent ticket failure, sometimes works, sometimes fails:

This might occur if your program code is written in JAVA, and you have chosen to use our default java example code. This code casts the ticket request as an INT. However, sometimes we return a ticket with a leading zero, which is truncated in JAVA, thus breaking the ticket request intermittently. The example code we ship shows this:

int ticket = getTrustedTicket(wgserver, user, request.getRemoteAddr());
if (ticket > 0) {...

with a signature of

private int getTrustedTicket(String wgserver, String user, String remoteAddr) throws ServletException

These should instead be typed as STRINGS

Invalid authenticity token error

This error results from a defect encountered in the shipping release of 5.1 - and is resolved by upgrading to 5.1.1

Invalid User (Sharepoint or C# specific)

Tableau Server ships with example code for a sharepoint DLL. This code references a ‘get' call:

SPContext.Current.Web.CurrentUser.Name

Please note that this will return the friendly "Display Name" of the current windows AD user. If you want to use the login ID, then you will need to change this code to:

SPContext.Current.Web.CurrentUser.LoginName

and then recompile the sharepoint DLL accordingly.