Repository navigation
Attempting to add a new user to site w/ SAML authentication #831
Description
Describe the bug
I have written a script that creates a batch of users based on json input. It works great with the exception of one caveat. My list of users only contains two users, and all users are created with SAML as their authentication method. When creating them, one of the users works fine, however one of them fails with the following error message. The user is still created, but is not created with "SAML" authentication. If I change the SAML authentication to ServerDefault, then everything works perfectly, and no exception is thrown. The only thing notable about the failing user is that every other site has the a username just like this one. This is essentially our global sso admin user.
403034: Forbidden
Only system administrators can add users to sites, query sites for user membership, or remove users from sites.
Versions
Details of your environment, including:
- Tableau Server version - 20204.21.0114.0916
- Python version - Python 3.9.2
- TSC library version - 0.14.0
To Reproduce
Below is my code that is handling the user creation. I only listed the portion of code that is failing and the snippet for configuring the server connection. I am calling this with an email address for the username, a basic name, and a role of 'explorer'. The server connection is configured with the new site that I am provisioning users for.
# configuration for tableau
server = TSC.Server( server_url, use_server_version=True )
tableau_auth = TSC.TableauAuth( username, password, site_name )
....
# function for creating users
def create_user( server, tableau_auth, username, full_name, user_role ):
with server.auth.sign_in( tableau_auth ):
try:
# Attempt to create New User
new_user = TSC.UserItem( username, user_role, auth_setting='SAML' )
user_item = server.users.add( new_user )
print( f'New User was Created: {username}'"\n" )
....
Results
403034: Forbidden
Only system administrators can add users to sites, query sites for user membership, or remove users from sites.
NOTE: Be careful not to post user names, passwords, auth tokens or any other private or sensitive information.
Activity
cody2094 commentedon Apr 15, 2021
I did some more digging into this issue and I guess Tableau refrains from letting us add a user as a "SAML" authenticated user on more than one site. Not sure why that is, but maybe this issue should just be focused on different error messaging? It may be out of the grounds for this repository. Let me know where the best place is to post something on this and I will. 🙃
jacalata commentedon Jun 9, 2021
This is a good place - I'll get that into our internal system for someone to fix the error message and maybe explain the limitation too.
fpagliar commentedon Jun 11, 2021
@cody2094 if you had two users with the same name, on different sites, marked as SAML then those would be effectively different people, each one of them would log in using a different SAML identity provider.
User disambiguation would become tricky in this case when starting the login flow on Tableau. Basically, you need extra information to figure out which IdP corresponds to a username. Tableau Online currently handles this by asking the user to provide username + site name, but OnPrem took the approach of only allowing one user to belong to one site.
github-actions commentedon Aug 18, 2026
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this is still relevant, please comment to keep it open.