Tableau desktop application doesn't authenticate when set to use EdgeSWG appliance

Products

• SG-S500
• ISG Proxy

Issue/Introduction

Users cannot authenticate in Tableau service using desktop application when proxied via an EdgeSWG appliance. 

Environment

Tableau desktop application is set to use an EdgeSWG appliance.

Cause

Tableau desktop application is sending user authorization token in HTTP header. By default EdgeSWG appliances are stripping sensitive headers/secrets from the clients requests - https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-3/overview4/_properties/authenticate-forward_credentials.html 

Resolution

Allow credentials forwarding for the Tableau authentication endpoint https://oauth2.googleapis.com/

<Proxy> 
url.domain=oauth2.googleapis.com authenticate.forward_credentials(yes)