In planning the migration of their Tableau Server from an Active Directory-based identity store to an LDAP-based system, what should be the primary…

When migrating Tableau Server's identity store from Active Directory to LDAP, the primary focus must be on the correct mapping and transfer of user roles and permissions. User identities are fundamentally changing from the AD format (e.g., domain\username) to an LDAP format (e.g., Distinguished Name). Tableau Server associates all content ownership, site roles (Creator, Explorer, etc.), and specific permissions with these user identities. A failure to accurately map the old identities to the new ones will result in users losing access to their content or being assigned incorrect privileges, thereby compromising both system usability and security. This mapping is the core objective of the identity migration process.

A. Migrating user passwords directly from Active Directory to LDAP is a significant security risk and often technically infeasible. Tableau authenticates against the external identity store; it does not manage or migrate the passwords themselves.

C. Relying on default settings in LDAP without custom configurations is incorrect. Every LDAP implementation has a unique schema and structure; Tableau Server requires specific connection and attribute mapping configurations to integrate successfully.

D. Completing the migration in the least possible time without testing is negligent. Such a critical change requires thorough testing in a non-production environment to prevent catastrophic failures, such as locking out all users.

1. Tableau Server Help

"Identity Migration": This official documentation outlines the migration process. It states

"The migration then maps permissions

content

and settings from the old user identities to the new ones." This directly supports that mapping permissions is the central task. (See section: "Plan the migration").

2. Tableau Server Help

"Identity Store": This document explains the implications of changing the identity store. It notes

"Changing the identity store after you have users and groups in Tableau Server is a process that requires careful planning... User names in Tableau Server must be unique

regardless of whether you are using a local identity store or an external identity store." This highlights the importance of managing the user identity transition carefully. (See section: "Changing the identity store").

3. Tableau Server Help

tsm identity-store set-connection: The documentation for this command

used to configure an external identity store

lists numerous mandatory parameters for LDAP connections (e.g.

hostname

port

bind credentials

user and group base DNs). This proves that default settings are insufficient and custom configuration is required

refuting option C. (See section: "Options" for LDAP).