Tableau Server returns -1 for the ticket value if it cannot issue the ticket as part of the trusted authentication process. The exact reason for this message is written to the file production*.log in the following folder:
ProgramData\Tableau\Tableau Server\data\tabsvc\logs\wgserver
Here are some things to confirm:
All web server IP addresses are added to trusted hosts
The IP address for the machine sending the POST request must be in the list of trusted hosts on Tableau Server. See Adding Trusted IP Addresses to Tableau Server to learn how to add IP addresses to this list.
Trusted hosts list is propertly formatted
The list of trusted hosts on Tableau Server must be a comma-separated list with a space after each comma. For example, the list should be similar to the following: 192.168.1.101, 192.168.1.102, 192.168.1.103, and so on.
IP addresses are IPv4
The list of IP addresses must be in Internet Protocol version 4 (IPv4) format. An IPv4 address looks like this: 123.456.7.890. IPv6 addresses (for example, fe12::3c4a:5eab:6789:01c2%34) are not supported.
Username in POST request is a valid Tableau Server user
The username you send in the POST request must be a licensed Tableau Server user with a Viewer or Interactor license level. You can see a list of users and their license levels by logging into Tableau Server as an administrator and clicking the Licensing link on the left side of the page.
Username in POST request includes domain
If Tableau Server is configured to use Local Authentication, the username that you send in the POST can be a simple string. However, if the server is configured for Active Directory you must include the domain name with the user name (domain\username). For example, the username parameter might be: username=dev\jsmith