Tableau Row Level Security Without entitlement table Entitlement table outside main database Entitlement table inside main database

Tableau Data Security Authentication - SSO >Hi, I am User x. Do I have access to Tableau server? Permissions >Hi, I am on server. Do I have access to any dashboards? Row Level Security >Hi, I can see dashboard. Which data sets I can see?

Returns true if current server user is a member of a group Tableau Row Level Security - ISMEMBEROF Row level security by Tableau server group : ISMEMBEROF(‘Group-West’) AND [Region] = ‘West’ Returns true if current server user is a member of a group

Tableau Row Level Security - ISMEMBEROF example used in Demo Server Groups ISMEMBEROF('Central Funiture') AND [Region] = 'Central' AND [Category] = 'Funiture' OR ISMEMBEROF('Central Supplies') AND [Region] = 'Central' AND [Category] = 'Office Supplies' OR ISMEMBEROF('Central Technology') AND [Region] = 'Central' AND [Category] = 'Technology' OR ISMEMBEROF('Central Team') AND [Region] = 'Central' OR ISMEMBEROF('West Funiture') AND [Region] = 'West' AND [Category] = 'Funiture' OR ISMEMBEROF('West Supplies') AND [Region] = 'West' AND [Category] = 'Office Supplies' OR ISMEMBEROF('West Technology') AND [Region] = 'West' AND [Category] = 'Technology' OR ISMEMBEROF('West Team') AND [Region] = 'West' OR ISMEMBEROF('East Funiture') AND [Region] = 'East' AND [Category] = 'Funiture' OR ISMEMBEROF('East Supplies') AND [Region] = 'East' AND [Category] = 'Office Supplies' OR ISMEMBEROF('East Technology') AND [Region] = 'East' AND [Category] = 'Technology' OR ISMEMBEROF('East Team') AND [Region] = 'East' OR ISMEMBEROF('South Funiture') AND [Region] = 'South' AND [Category] = 'Funiture' OR ISMEMBEROF('South Supplies') AND [Region] = 'South' AND [Category] = 'Office Supplies' OR ISMEMBEROF('South Technology') AND [Region] = 'South' AND [Category] = 'Technology' OR ISMEMBEROF('South Team') AND [Region] = 'South' OR ISMEMBEROF('Worldwide')

Tableau Row Level Security - ISMEMBEROF Workbook Filter Steps: Create groups on Tableau server Connect to data sources Create calculated field ISMEMBEROF('Central Funiture') AND [Region] = 'Central' AND [Category] = 'Funiture' OR ISMEMBEROF('Central Supplies') AND [Region] = 'Central' AND [Category] = 'Office Supplies' OR ….. Add the calculated field to workbook filter and select ‘true’ After publish workbook, set permission to all the groups above Make sure Web Editing as No, download as No.

Tableau Row Level Security - ISMEMBEROF Data Source Filter Steps: Create groups on Tableau server Connect to data sources Create calculated field ISMEMBEROF('Central Funiture') AND [Region] = 'Central' AND [Category] = 'Funiture' OR ISMEMBEROF('Central Supplies') AND [Region] = 'Central' AND [Category] = 'Office Supplies' OR ….. Add the calculated field to data source filter and select ‘true’ After publish data sources, set permission to connect for publishers 6. The workbook publishers can connect to the published data source to create dashboards with built-in row level security in data source 7. It is Ok to have web edit permission now on workbook

Published Data Sources Analysis/Reporting Curated “Semantic layer” Reusable SSoT Less load to source data Security Integration Develop dashboards Publish dashboards for end users

1 2 3 Tableau Row Level Security - USERNAME() X-DB joins with user entitlement table (v10 feature) 1 2 USERNAME() returns the current Tableau server Username USERNAME()=[User] can be data source filter or workbook filter Permission setting follow ISMEMBEROF approach 3

1 2 3 Tableau Row Level Security - USERNAME() DB blending with user entitlement table 1 2 USERNAME() returns the current Tableau server Username USERNAME()=[User] can be data source filter or workbook filter Permission setting follow ISMEMBEROF approach 3

2 1 3 Tableau Row Level Security - USERNAME() X-DB Filter with user entitlement table (v10 feature) 2 1 USERNAME() returns the current Tableau server Username USERNAME()=[User] as workbook filter for all related data sources Permission setting follow ISMEMBEROF approach 3

USERNAME() gets the current Tableau server username USERNAME() gets the current Tableau server username. Can USERNAME() pass this current server username to live connection database? USERNAME() can’t pass the current server username to live connection DB. But Query Banding or Initial SQL does

Tableau Row Level Security - Live Connection Query Banding - TeraData ProxyUser = <ProxyUser> TableauMode=<TableauMode> TableauApp=<TableauApp> Tableau Version=<TableauVersion> WorkbookName=Name of DataSource Initial SQL - Vertica, Oracle, SQL Server, Sybase ASE, Redshift, and Greenplum [TableauServerUser] [TableauServerUserFull] [TableauApp] [WorkbookName]

Row Level Security Summary Data Sources Data Visualization Data Consumers Tableau Server Published Data Source Workbook ISMEMBEROF(‘Group’) ProxyUser =<ProxyUser> [TableauServerUser] USERNAME()=[User] X-DB join (no extract on secondary data source) Blending (limited functions on secondary data source) X-DB filtering(can’t do data source filter)

Row Level Security Scenarios and Solutions # Scenarios Row Level Security Options How Work with Extracts Performance Add new users Limitations 1 W/O entitlement table ISMEMBEROF Tableau Server group to control Yes Good Self-Service Hard to deal with 30+ groups 2 Entitlement table outside main DB USERNAME() User entitlement table outside data source Depends Moderate Validate potential dups 3 Entitlement table inside main DB Query Banding/Initial SQL User entitlement table in data source No Difficult Performance & user management Tableau Desktop Publishers

Tableau row level security works for extracts Key Takeaways Tableau row level security works for extracts Multiple options available for Tableau row level security Use published data sources to integrate row level security