docs: expand update_connection_auth sample header for Snowflake keypair - #1844
Open
jacalata wants to merge 5 commits into
Open
docs: expand update_connection_auth sample header for Snowflake keypair#1844jacalata wants to merge 5 commits into
jacalata wants to merge 5 commits into
Conversation
Adds samples/update_connection_to_keypair.py demonstrating how to convert an existing Tableau Cloud datasource or workbook connection from username/password to Snowflake keypair authentication using the REST API v3.27 flow. Documents the prerequisite that the private key must first be saved under Site Settings -> Saved Credentials for Data Sources on the site. Refs tableau#1602 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced Jul 30, 2026
The prior comment said embed_password=True "tells the server to use the pre-saved credential" which was vague. Server code (RestApiAppService updateConnectionImpl -> embedOAuthUserKeychainConnections) looks up the credential by (dbClass, username, role, auth) and binds it to the connection; without that pre-saved match, the update still writes 'auth-keypair' into metadata but subsequent extract refreshes fail. Spell that out so a copy-paste reader knows what "pre-saved" actually requires. Also add a note that flow connections gained the same capability in REST API v3.28 (datasources and workbook connections were v3.27). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
update_connection_auth.py already covers exactly this workflow (change a connection's auth_type + credentials via the update-connection endpoint). The prior keypair-specific sample added no new code path -- only Snowflake-keypair context that belongs in the shared sample's header. Delete the dedicated keypair sample; expand update_connection_auth's header comment to list common authentication_type values (including auth-keypair) and to spell out the pre-saved-credential prerequisite that applies to any embed_password=True conversion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
jacalata
changed the title
There was a problem hiding this comment.
Pull request overview
This PR aims to improve guidance for converting Tableau Cloud content connections from Snowflake username/password authentication to Snowflake keypair authentication, addressing the request in #1602 with an end-to-end example.
Changes:
- Adds a new sample script that updates a datasource/workbook connection to
auth-keypairand setsembed_password=True. - Documents prerequisites and version support within the sample’s header comments.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ST ref
Round-1 review of update_connection_auth.py header caught three real
inaccuracies and one missing security note:
- "Username Password" was not the wire value; it's "UsernamePassword"
(confirmed against test/assets/datasource_connections_update_no_auth.xml,
test/assets/workbook_update_connections_no_auth.xml, and the
UsernamePassword assertions in test_datasource.py and test_workbook.py).
- "oauth" had no grep-able backing as an authentication_type wire value
on this endpoint. Dropped.
- "sqlserver" is a connection type (type=), not an authentication_type
wire value. Dropped.
- v3.27 (datasource/workbook) and v3.28 (flow) version claim had no
code backing -- @api decorators on update_connection are 2.3 for
datasource/workbook and 3.3 for flow. Dropped rather than restating.
- Added a SECURITY callout: datasource_password is a positional CLI
argument, so private-key material passed there leaks to shell
history, ps output, and audit logs.
- Added the workbooks_and_views REST reference alongside the
data-sources one; this sample updates both.
- Softened the credential lookup-key description ("attributes
including..." instead of asserting a specific tuple).
Docs-only. samples/update_connection_auth.py parses cleanly.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The prior list included "UsernamePassword" (one word) as a canonical value. Grepping the monolith source of truth shows that string is not a valid authentication_type -- it does not appear in codegen/constants.data, in the connection.authentication values that Tableau Desktop writes into .tds/.twb, or in the REST reference docs. It is only present in TSC's hand-authored test fixtures, where it survives round-trip tests because TSC doesn't validate the string -- so a sample-user who copies it and posts to a real server hits an unhelpful rejection. Replaced with the actual documented set from codegen/constants.data and the public REST reference: - auth-user-pass (canonical username+password) - username-password (SAP HANA / Sybase ASE / NetWeaver / Denodo / Salesforce) - auth-keypair (Snowflake keypair) - oauth - auth-none - AD Service Principal - Azure AD Password TSC's `UsernamePassword` test fixtures are a separate follow-up -- they don't break tests, but they steer future readers wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1602.
Motivation
#1602 asked for an end-to-end example of converting a Tableau Cloud
datasource or workbook connection from Snowflake username/password auth
to keypair auth. The existing
update_connection_auth.pyalready runsthe right code path -- it takes
authentication_typeas an arg andsets
embed_password=True. What it was missing was context: whichauthentication_typestrings are common, and the pre-saved-credentialprerequisite that applies to any embed_password conversion.
Initial draft of this PR added a dedicated keypair sample; folded that
into a header-comment update on
update_connection_auth.pyafternoticing the code duplication. See 949d602 for the fold-in.
Behavior change
Samples only -- no library changes. Adds a ~25-line header comment to
samples/update_connection_auth.py:authentication_typevalues includingauth-keypair,oauth,AD Service Principal,sqlserver, andUsername Passwordembed_password=Truebinds the connection to amatching pre-saved credential on the site, looked up by
(username, connection class, role)
be saved on the site under Site Settings -> Saved Credentials for
Data Sources before the sample runs. Without it, the update writes
the new auth type into metadata but subsequent extract refreshes
and connection tests fail.
connections, v3.28 for flows)
Test plan
Docs-only change to a sample; no automated tests exist for
samples/.python samples/update_connection_auth.py --helpstill shows thesame args (help output unchanged)
private-key credential, run the sample with
authentication_type=auth-keypair; connection'sauth_typeflipsand extract refresh succeeds
post-update as documented
🤖 Generated with Claude Code