From February 1st, 2022, Multi-factor authentication (MFA) will become a requirement for Tableau Online. This feature is designed to increase the security of your accounts and safeguard your data – but it may also disrupt your existing pipelines of data from Alteryx to Tableau and any other API integrations.
What is Changing?
Whether your organization authenticates using SSO or Tableau accounts, MFA should be enabled by February 1st. If your company uses SSO, you can meet this requirement by enforcing MFA with platforms such as Google OpenID, Salesforce, or Azure Active Directory. However, if you want to stick with a Tableau login, Tableau will begin to turn MFA on from this date. Your site admins will still have the option to disable MFA for now, but later this year it will be enforced and no option will be given.
More details on Salesforce products MFA enforcement roadmap: https://help.salesforce.com/s/articleView?language=en_US&type=1&id=000362737
Why is This Important?
MFA makes it impossible to log in using only a username and password: this applies to signing into Tableau Online through a browser or connecting to the Tableau REST API. If you have any Alteryx workflows that publish to Tableau by authenticating using only a username and password, these will no longer work once MFA is enabled.
How to Fix This Issue
If you have any projects that require the use of the Tableau API, such as the Publish to Tableau Server tool in Alteryx, you will need to change the configuration for your projects to run successfully. Critically, you will need to use a Personal Access Token (PAT) instead of a username/password combination to authenticate to Tableau Online.
1. Generate a PAT
Generating a PAT is simple and can be done either by individual users or for a single service account (more on this below).
Reference https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm
Go to your account settings in Tableau Online, and about halfway down the page, you will see a small section on Personal Access Tokens. Here you can generate any new PATs by simply entering a name you wish to use.
After clicking the button, Tableau will provide you with the secret token key, which you will need to store safely.
Note that PATs:
- Will be revoked if they are inactive for 15 days after creation
- Must be updated at least once a year
2. Publishing in Alteryx Using the PAT
The most used tool to publish to Tableau Server in Alteryx does not support PATs. However, Alteryx has released an alternative “Tableau Output” tool that does not come standard with your Alteryx install. You can find the Alteryx-published tool on the gallery here: https://community.alteryx.com/t5/Public-Community-Gallery/Tableau-Output-Tool/ta-p/877902
You can also find documentation on the alternative tool here: https://help.alteryx.com/20213/designer/tableau-output-tool
An important limitation to note with using PATs is that the Tableau API will only accept one in use at a time. This means you will need to generate and use a different PAT for each tool instance to avoid any authorization issues when running workflows concurrently.
A couple of example situations are:
- Single workflow with 3 Tableau Output tools (you will need 3 PATs, 1 for each tool).
- Three workflows with 1 Tableau Output tool each (you will need 3 PATs, 1 for each workflow).
- Two workflows, one with two Tableau Outputs and three Tableau Outputs (you will need 5 PATs, 1 for each tool/workflow).
Generating PATs for Individuals or a Service Account
Just as before, you have the choice between letting users authenticate via their own individual Tableau accounts or through a single service account.
A service account is simply an account created on the Tableau Server to handle non-individual specific tasks (such as data refreshes). There is no technical difference between a service account and an ordinary user – the difference lies in how it is implemented and adopted by users.
Either option will allow you to use PATs to publish to the Tableau server. Whereas in the former option, individuals generate their own PATs on Tableau Online, in the latter, PATs are generated and distributed from a single account and used by potentially multiple end-users.
There are advantages to both approaches:
Using the Tool With Alteryx Server/Scheduler
As of writing (01/31/22), the Tableau Output tool does not currently work with the scheduler or the Alteryx Gallery. We have a modified version of the deprecated Publish to Tableau Server tool that will accept PATs which will act as a temporary workaround.
https://community.alteryx.com/t5/Public-Community-Gallery/Publish-to-Tableau-Server-PAT/ta-p/896683
If you want to automate workflows with the tool, you need to install it on the Alteryx Server. You can install custom tools by opening Alteryx Server as an administrator on the Server, opening the .yxi file within, and selecting “Install for all users.”
You can find more information here:
https://help.alteryx.com/20204/server/install-custom-tools
