Google Drive tools work for an hour and half and then error

[csh8428]

I already have a ticket with support about this, but figured I'd post here in case anyone has any input. 

High level:

• Desktop designer and gallery on 2023.2
• I am an Alteryx server admin and an admin of the physical server itself
• Workflows with google drive work from desktop designer
• Upload workflow to gallery. If manual run is done within 1.5 hours it will work. It will fail after 1.5 hours
• Scheduled gallery workflow runs within 1.5 hours of uploading and stops working after 1.5 hours
• Error received: "Connection to platform was not successful"

Further details

This seemed to start after these 2 events:

• IT applied a patch to our server, but IT says the patch couldn't have caused this. I doubt they know if that is actually the case.
• I installed V1.3.3 of the google drive tools. I also had 1.2.1, 1.30, 1.3.1 installed as well
• Whether or not 1 or both things things caused the issue I have no idea

I deleted ALL the tools from %ALLUSERSPROFILE%\Alteryx\Tools on the server as well as my .shiv folder on the server and reinstalled just 1.3.3. Same sequence of events occurred as noted in "High Level" above, so that didn't fix the issue.

I've tried it with all those tool versions noted and have the same issue with all tool versions.

I think it has something to do with google authentication, but I don't know if it's a tool issue or internal issue.. here's why

1. The scheduled workflows work for 1.5 hours and then fails.
2. If I open the workflow in desktop designer after it fails and click on one of the tools as soon as it opens; the tool config is blank. If I let the workflow sit for a few minutes the tool config is back.
3. If I open the workflow in desktop designer after it fails, let it sit for a few minutes to let the tool config re-populate, and then close the workflow WITHOUT SAVING IT to the gallery, the manual and scheduled runs work again.... for 1.5 hours.

[apathetichell]

Are you connecting via Oauth/JWT or DCM? This sounds like the upload is authenticating as the local user (Designer) and when their Gdrive connection timesout ---> your workflow doesn't run. You need to connect via an Oauth App (Client ID/Secret) via DCM or a GCP Service Account's keys (.json file with a .jwt and various other cool pieces of info).

If you are avid GCP/workspace user and interested in a redesign to better tie Alteryx server into your holistic GCP/Gsuite landscape -> I'm down to do some consulting in this specific use case.

[csh8428]

@apathetichell Using DCM. We don't have access to the client secret(or to get it through the google developer console) and I doubt IT will give it to me.

[apathetichell]

Can you confirm that the builder who is using this on Designer is also authenticating to Gdrive via the Server DCM connection? This does sound like local/personal auth timing out.

My recommendations are:

1) check on DCM/DCM connections.

2) check out the redirect URI in your DCM/GCP Oauth setup (yes -> you'll have to talk to your GCP team).

3) Beg for a JSON service account key (can be a GCP binary secret) so you can get this to server and then code it yourself.

4) --- reach out to me about rearchitecting this. I can sketch out to your GCP team how I'd make more this more palatable for them -> mostly it's shifting the connection from Alteryx -> Gsheets/Gdrive to Gsheets/Gdrive -> Alteryx and all the secondary changes that you need for that architecture.

[csh8428]

@apathetichell I am the one doing all of this. Yes, I'm using the server DCM connection.

I got the client secret. I created a new DCM connection using the client ID and client secret. The scheduled workflow worked for a half hour, then failed again.

[apathetichell]

When you build the workflow in Designer/Test in Designer ---> how are you connecting?

I'm not 100% sure that this works - but let's go through how it SHOULD work:

In designer you are using DCM to connect via OAUTH (or something).

Your DCM is set up in Server (and propagates to Designer).

Your redirect URI set up for your app registration in GCP which generated your Client ID/Client Secret is reachable from your server and your designer.

If your issue is still specifically the timeout that you are seeing -> this looks like you are authenticating as a user and Alteryx relying upon your personal JWT vs trying to create the oauth flow from Server.

The easiest way to do fix this would be to create a .json file service account key for a service account principal. Connect via that .json file. The only other ways that I can see fixing this are "complicated" and to be honest require significant re-envisioning of how you use Server/Gsuite/GCP. I believe the later is a 'better' solution for more restricted/more current tech stack companies tech stack -> but this solution is really only relevant for companies who use gsuite extensively -> and ideally whose Server is either on a GCP VM or an AWS EC2 with a GCP OIDC (workload identity federation) set up and the GCP CLI installed.