You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2022/08/23 10:44:24 UTC
[GitHub] [airflow] baruch-shteken opened a new issue, #25904: Support Personal access token method for Tableau Connection
baruch-shteken opened a new issue, #25904:
URL: https://github.com/apache/airflow/issues/25904
### Description
In Tableau Online, you can use user name and password method for REST API calls, [only if you don't use MFA](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm).
Thus, organizations that enabled MFA in Tableau, have to use [Personal Access Tokens](https://help.tableau.com/current/online/en-us/security_personal_access_tokens.htm) for API calls to Tableau.
However, [Airflow deprecated the usage of Personal Access Tokens](https://github.com/apache/airflow/pull/16916) in [airflow.providers.tableau.hooks.tableau](https://airflow.apache.org/docs/apache-airflow-providers-tableau/stable/_modules/airflow/providers/tableau/hooks/tableau.html), since [there is a problem](https://github.com/apache/airflow/issues/16669) that each time you try to open a parallel connection, the previous one would be invalidated.
### Use case/motivation
I would like to use the Personal Access Token method for API calls to Tableau.
I see 2 solutions that might be applicable:
1. Create 1 connection to Tableau and use that for all API calls from Airflow in a specific timeframe. I am not sure if this is feasible
2. Create a pool of tokens and for each connection to Tableau from Airflow, create a new connection id with 1 of the unused tokens. I saw that on Airflow, you can [generate connection on the fly](https://airflow.apache.org/docs/apache-airflow/1.10.14/howto/connection/index.html#generating-a-connection-uri). I am not sure how to handle the token pool though
I am open to other solutions and guidance. Also, I am not sure I can submit a PR since I have never contributed to an open source project but I can try.
### Related issues
_No response_
### Are you willing to submit a PR?
- [X] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] baruch-shteken commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by GitBox <gi...@apache.org>.
baruch-shteken commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1227222473
As I understand from [Tableau Python SDK docs](https://tableau.github.io/server-client-python/docs/api-ref#personalaccesstokenauth-class), there are no parameters for `PersonalAccessTokenAuth` class that we can use to mitigate the issue.
The problem is that only 1 connection can be used for each token simultaneously.
Again, I am not sure how to solve it but Tableau Python SDK doesn't seem to hold the answer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] baruch-shteken commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by GitBox <gi...@apache.org>.
baruch-shteken commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1285823875
I looked at this issue again and when an authentication is made with a PAT then the `site_id` and `credentials_token` are obtained. `credentials_token` is valid for 4 hours and should be able to be used with parallel processes. Hence, for PATs, the Airflow code should use the obtained `site_id` and `credentials_token` after the first authentication and not create a new ones from the PATs (unless 4 hours passed)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] TRBaldim commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by "TRBaldim (via GitHub)" <gi...@apache.org>.
TRBaldim commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1537559676
Thanks @potiuk for your comment about the generated tokens. I will check and try to keep this updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] eladkal commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by GitBox <gi...@apache.org>.
eladkal commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1223916926
>Create 1 connection to Tableau and use that for all API calls from Airflow in a specific timeframe. I am not sure if this is feasible
Create a pool of tokens and for each connection to Tableau from Airflow, create a new connection id with 1 of the unused tokens. I saw that on Airflow, you can [generate connection on the fly](https://airflow.apache.org/docs/apache-airflow/1.10.14/howto/connection/index.html#generating-a-connection-uri). I am not sure how to handle the token pool though
These are not the way to go.
You need to research how Tableau Python SDK is expecting to make the connection and then add support for it from Airflow side. For example in Google we support 2 options for authentications:
https://airflow.apache.org/docs/apache-airflow-providers-google/stable/connections/gcp.html#authenticating-to-google-cloud
We can probably support any method that the SDK allows. So the action item here is to check what the SDK allows and add proper support for it from Airflow side.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] TRBaldim commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by "TRBaldim (via GitHub)" <gi...@apache.org>.
TRBaldim commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1535687003
Yeah, that is the same here. With the MFA enforced, we are using multiple tokens. But the library with the tokens is pretty broken and not even recommended by Airflow to be used. Would love to see a solution for this and ensure a better handling of this weird:
```
401002: Unauthorized Access
Invalid authentication credentials were provided.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Support Personal access token method for Tableau Connection [airflow]
Posted by "simonprydden (via GitHub)" <gi...@apache.org>.
simonprydden commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1858830773
@baruch-shteken would [Sign in with JSON Web Token (JWT)](https://tableau.github.io/server-client-python/docs/sign-in-out#sign-in-with-json-web-token-jwt) work with multiple connections?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] eladkal commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by GitBox <gi...@apache.org>.
eladkal commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1287389471
feel free to submit PR if you have a fix.
you can also write code that regenerate token before they expire. Example: https://github.com/apache/airflow/pull/17951
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1223889259
Thanks for opening your first issue here! Be sure to follow the issue template!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Support Personal access token method for Tableau Connection [airflow]
Posted by "Michae94 (via GitHub)" <gi...@apache.org>.
Michae94 commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1910425450
> @baruch-shteken would [Sign in with JSON Web Token (JWT)](https://tableau.github.io/server-client-python/docs/sign-in-out#sign-in-with-json-web-token-jwt) work with multiple connections?
I do think so indeed, as you could dynamically create different JWT for one connected app (Airflow).
https://help.tableau.com/current/online/en-us/connected_apps_direct.htm
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] Michae94 commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by "Michae94 (via GitHub)" <gi...@apache.org>.
Michae94 commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1528040461
Hey, I am posting a comment here as, now, MFA is enforced on Tableau cloud. Thus, user/password is not available anymore for Tableau connection with a service account.
For now, I am using multiple token (1 for each concurrent task).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] Rociogonzalez commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by "Rociogonzalez (via GitHub)" <gi...@apache.org>.
Rociogonzalez commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1448064536
Hi,
I have the same problem to use Tableau with PAT. Any progress on this? What option have you taken?
We were thinking of putting the tasks in airflow pools and having a pool of tokens
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #25904: Support Personal access token method for Tableau Connection
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1536086744
> Yeah, that is the same here. With the MFA enforced, we are using multiple tokens. But the library with the tokens is pretty broken and not even recommended by Airflow to be used. Would love to see a solution for this and ensure a better handling of this weird:
>
> ```
> 401002: Unauthorized Access
> Invalid authentication credentials were provided.
> ```
Yeah. submitting a PR to this one is most welcome. Also (not sure how tableau does it) but various services usually allow to generate token - usually with limited capabilities - and use it as a password when MFA is enabled (for example GitHub does it - you can authenticate with your login (which is not really needed and can be anything) and provide the token as password. Maybe (guessing) Tableau has similar feature.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Support Personal access token method for Tableau Connection [airflow]
Posted by "baruch-shteken (via GitHub)" <gi...@apache.org>.
baruch-shteken commented on issue #25904:
URL: https://github.com/apache/airflow/issues/25904#issuecomment-1761646107
I started working on fixing this issue.
I read the [Tableau Python SDK docs](https://tableau.github.io/server-client-python/docs/api-ref#personalaccesstokenauth-class) and I didn't see any meaningful feature that can help solving this problem.
I decided that what I can do changing the connection setting in the Tableau hook.
Instead of generating the connection 1 time when the hook is initialized ([__enter__ function](https://github.com/apache/airflow/blob/main/airflow/providers/tableau/hooks/tableau.py#L98)), I would like the tableau connection to be set before any API request to Tableau. This should solve the problem because the Tableau session_token will be newly generated before every call.
The problem is that I don't know how to write a test for that. I need to write a test that checks how many times `tableau_conn` was set to a value after mocking a Tableau API call (current code 1 time, my code 2 times). I looked into the exiting unit tests for the [TableauHook class](https://github.com/apache/airflow/blob/main/tests/providers/tableau/hooks/test_tableau.py) but I didn't get any inspiration of how to create my test. Can anyone help me in this approach?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org