1. Tableau Row Level Security
Without entitlement table
Entitlement table outside main database
Entitlement table inside main database

2. Tableau Data Security
Authentication - SSO
>Hi, I am User x. Do I have access to Tableau server?
Permissions
>Hi, I am on server. Do I have access to any dashboards?
Row Level Security
>Hi, I can see dashboard.
Which data sets I can see?

5. Returns true if current server user is a member of a group
Tableau Row Level Security - ISMEMBEROF
Row level security by Tableau server group :
ISMEMBEROF(‘Group-West’) AND [Region] = ‘West’
Returns true if current server user is a member of a group

6. Tableau Row Level Security - ISMEMBEROF example used in Demo
Server Groups
ISMEMBEROF('Central Funiture') AND [Region] = 'Central' AND [Category] = 'Funiture' OR
ISMEMBEROF('Central Supplies') AND [Region] = 'Central' AND [Category] = 'Office Supplies' OR
ISMEMBEROF('Central Technology') AND [Region] = 'Central' AND [Category] = 'Technology' OR
ISMEMBEROF('Central Team') AND [Region] = 'Central' OR
ISMEMBEROF('West Funiture') AND [Region] = 'West' AND [Category] = 'Funiture' OR
ISMEMBEROF('West Supplies') AND [Region] = 'West' AND [Category] = 'Office Supplies' OR
ISMEMBEROF('West Technology') AND [Region] = 'West' AND [Category] = 'Technology' OR
ISMEMBEROF('West Team') AND [Region] = 'West' OR
ISMEMBEROF('East Funiture') AND [Region] = 'East' AND [Category] = 'Funiture' OR
ISMEMBEROF('East Supplies') AND [Region] = 'East' AND [Category] = 'Office Supplies' OR
ISMEMBEROF('East Technology') AND [Region] = 'East' AND [Category] = 'Technology' OR
ISMEMBEROF('East Team') AND [Region] = 'East' OR
ISMEMBEROF('South Funiture') AND [Region] = 'South' AND [Category] = 'Funiture' OR
ISMEMBEROF('South Supplies') AND [Region] = 'South' AND [Category] = 'Office Supplies' OR
ISMEMBEROF('South Technology') AND [Region] = 'South' AND [Category] = 'Technology' OR
ISMEMBEROF('South Team') AND [Region] = 'South' OR
ISMEMBEROF('Worldwide')

7. Tableau Row Level Security - ISMEMBEROF Workbook Filter
Steps:
Create groups on Tableau server
Connect to data sources
Create calculated field
ISMEMBEROF('Central Funiture') AND [Region] = 'Central' AND [Category] = 'Funiture' OR
ISMEMBEROF('Central Supplies') AND [Region] = 'Central' AND [Category] = 'Office Supplies' OR
…..
Add the calculated field to workbook filter and select ‘true’
After publish workbook, set permission to all the groups above
Make sure Web Editing as No, download as No.

8. Tableau Row Level Security - ISMEMBEROF Data Source Filter
Steps:
Create groups on Tableau server
Connect to data sources
Create calculated field
ISMEMBEROF('Central Funiture') AND [Region] = 'Central' AND [Category] = 'Funiture' OR
ISMEMBEROF('Central Supplies') AND [Region] = 'Central' AND [Category] = 'Office Supplies' OR
…..
Add the calculated field to data source filter and select ‘true’
After publish data sources, set permission to connect for publishers
6. The workbook publishers can connect to the published data source to create dashboards with built-in row level security in data source
7. It is Ok to have web edit permission now on workbook

9. Published Data Sources
Analysis/Reporting
Curated “Semantic layer”
Reusable
SSoT
Less load to source data
Security Integration
Develop dashboards
Publish dashboards for end users

10. 1 2 3 Tableau Row Level Security - USERNAME()
X-DB joins with user entitlement table (v10 feature) 1 2
USERNAME() returns the current Tableau server Username
USERNAME()=[User] can be data source filter or workbook filter
Permission setting follow ISMEMBEROF approach 3

11. 1 2 3 Tableau Row Level Security - USERNAME()
DB blending with user entitlement table 1 2
USERNAME() returns the current Tableau server Username
USERNAME()=[User] can be data source filter or workbook filter
Permission setting follow ISMEMBEROF approach 3

12. 2 1 3 Tableau Row Level Security - USERNAME()
X-DB Filter with user entitlement table (v10 feature) 2 1
USERNAME() returns the current Tableau server Username
USERNAME()=[User] as workbook filter for all related data sources
Permission setting follow ISMEMBEROF approach 3

13. USERNAME() gets the current Tableau server username
USERNAME() gets the current Tableau server username. Can USERNAME() pass this current server username to live connection database?
USERNAME() can’t pass the current server username to live connection DB. But Query Banding or Initial SQL does

14. Tableau Row Level Security - Live Connection
Query Banding - TeraData
ProxyUser = <ProxyUser>
TableauMode=<TableauMode>
TableauApp=<TableauApp>
Tableau Version=<TableauVersion>
WorkbookName=Name of DataSource
Initial SQL - Vertica, Oracle, SQL Server, Sybase ASE, Redshift, and Greenplum
[TableauServerUser]
[TableauServerUserFull]
[TableauApp]
[WorkbookName]

15. Row Level Security Summary
Data Sources
Data Visualization
Data Consumers
Tableau Server
Published Data Source
Workbook
ISMEMBEROF(‘Group’)
ProxyUser =<ProxyUser>
[TableauServerUser]
USERNAME()=[User]
X-DB join (no extract on secondary data source)
Blending (limited functions on secondary data source)
X-DB filtering(can’t do data source filter)

16. Row Level Security Scenarios and Solutions#
Scenarios
Row Level Security Options
How
Work with Extracts
Performance
Add new users
Limitations 1
W/O entitlement table
ISMEMBEROF
Tableau Server group to control
Yes
Good
Self-Service
Hard to deal with 30+ groups 2
Entitlement table outside main DB
USERNAME()
User entitlement table outside data source
Depends
Moderate
Validate potential dups 3
Entitlement table inside main DB
Query Banding/Initial SQL
User entitlement table in data source No
Difficult
Performance & user management
Tableau Desktop
Publishers

17. Tableau row level security works for extracts
Key Takeaways
Tableau row level security works for extracts
Multiple options available for Tableau row level security
Use published data sources to integrate row level security