How is Alteryx affected by Tableau's decision to require Multi-Factor Authentication (MFA) for connecting to Tableau Online?

[vijayakarthikeyan]

How is Alteryx affected by Tableau's decision to require Multi-Factor Authentication (MFA) for connecting to Tableau Online?

Alteryx is aware of Tableau’s decision to require Multi-Factor Authentication (MFA) for connecting to Tableau Online as of February 1^st, 2022, and we have made sure to develop a connector that supports this change. This article helps to mitigate this challenge from Alteryx Designer/Server. Alteryx has two tools using the API: A legacy Publish to Tableau Server connector and newer tool Tableau Output. 

After switching to MFA on Tableau Online, the Publish To Tableau Server tool will no longer operate because authentication will require the use of a Personal Access Token. This is due to the requirements of Tableau's API, which only supports MFA via the use of Personal Access Tokens.
 

Prerequisites

 

• Alteryx Designer/Server
  • All versions
• Tableau Online
• Publish to Tableau Server Tool or Tableau Output tool

Procedure

Note: If you are already using the Tableau Output connector with a Personal Access Token, no further action is required.

The required steps will depend on:

• If you are publishing workflows containing a Tableau tool to Alteryx Server
• If you are using the Publish to Tableau Server tool or Tableau Output tool
• What version of Alteryx you are running

In all cases, you will need to replace the Publish to Tableau Server tool with the Tableau Output tool and use the authentication method "Personal Access Token":
 

 

Scenario 1: For Alteryx Server

 

NOTE: If you schedule workflows on Server or upload workflows to the Gallery that contain a Tableau tool, follow the steps in this section.

I am using the Publish to Tableau Server tool

 

1. Replace the Publish to Tableau Server tool with the Tableau Output tool:
   1. This connector is compatible with Alteryx Server 2021.3. 
   2. If you are on version <= 2021.2, you will need to upgrade your Server in order to schedule workflows containing the Tableau Output tool.
      • If you need time to prepare for the upgrade, as a workaround you can use the Tableau Output tool in Alteryx Designer - manual runs will work in lower Designer versions. See the section "Tableau Output Designer Compatibility" below to determine which version of the tool matches your Designer version.
2. Configure the tool with the Personal Access Token authentication method.
   • The "Personal Access Token" authentication type can be configured in Tableau, and used in Alteryx Designer using the steps discussed in this article.

I am using the Tableau Output tool

 

1. You must be on Alteryx Server version 2021.3 to run this tool on Server.
2. Configure the tool with the Personal Access Token authentication method.
   • The "Personal Access Token" authentication type can be configured in Tableau, and used in Alteryx Designer using the steps discussed in this article.

I only use the tool in Alteryx Designer

 

1. You will need to download the Tableau Output tool.
   • The version you can download will depend on your Alteryx Designer version. When possible, upgrade to version 2021.3 to utilize the latest version of the tool. See the section "Tableau Output Designer Compatibility" below to determine which version of the tool matches your Designer version.
2. Replace the Publish to Tableau Server tool with the Tableau Output  tool.
3. Configure the tool with the Personal Access Token authentication method.
   • The "Personal Access Token" authentication type can be configured in Tableau, and used in Alteryx Designer using the steps discussed in this article.

 

Scenario 2: For Alteryx Designer

 

NOTE: This section only applies to users with Designer only - if you are scheduling or publishing to Alteryx Server, see the section above.

I am using the Publish to Tableau Server tool

 

1. Replace the Publish to Tableau Server tool with the Tableau Output  tool.
   1. The tool version you can download will depend on your Alteryx Designer version. When possible, upgrade to version 2021.3 to utilize the latest version of the tool. See the section "Tableau Output Designer Compatibility" below to determine which version of the tool matches your Designer version.
2. Configure the tool with the Personal Access Token authentication method.
   • The "Personal Access Token" authentication type can be configured in Tableau, and used in Alteryx Designer using the steps discussed in this article.

 

I am using the Tableau Output tool

 

1. Configure the tool with the Personal Access Token authentication method.
   • The "Personal Access Token" authentication type can be configured in Tableau, and used in Alteryx Designer using the steps discussed in this article.

 

Tableau Output Designer Compatibility

 

NOTE: If you schedule workflows on Server or upload workflows to the Gallery that contain a Tableau tool, the table below is only for running the workflow manually in Designer. 2021.3 is the minimum required version to publish the tool to Alteryx Server.

 

Tableau Output version	Designer minimum version
1.0.0	2020.4
1.1.0	2021.2
1.1.1	2021.2

 
When possible, upgrade to version 2021.3 to utilize the latest version of the tool.
Please also check the Release Notes on the tool's download page to learn what features are included in each version.

FAQs

Why does this change impact Alteryx?

Alteryx's tools use Tableau's API. This change to MFA impacts Tableau's API and requires the use of a Personal Access token. Refer to Tableau's documentation for more information. See section 'What do I need to do with other Tableau products in order to use the new "Tableau with MFA" authentication type?'.

Does this impact Tableau On-Prem?

It is our understanding that the announcement for MFA being forced does not impact Tableau On-prem servers; only Tableau Online. 
 

Additional Resources

 

• KB Article: How to configure Personal Access Token in Alteryx?
• Link to download Tableau Output tool from Alteryx's Community Gallery
• Tableau KB Article: Tableau Online MFA (multi-factor authentication) FAQ | Tableau Software
• Tableau Help Documentation: Tableau - Personal Access Token

[eccl318]

We have incorporated the new tool into our workflows and can successfully update Tableau running those workflows using a generic PAT on our individual machine designers.  We can also successfully publish the new workflows to gallery.  However, when run on gallery, the workflows fail with error 'Failed to signin to Tableau'.  

Any ideas as to what is happening?

[balders-ie]

@eccl318 I get the same.

Tool Version: 1.1.1

Alteryx Version: 2021.3.4 (Designer and Server)

[eccl318]

@balders-ie Having a meeting today concerning this with their tech folks.  First step was making a change in registry file to allow python to pass encryption of credentials.  But that didn't work either.  We're doing some deep dive tracking today to see where the issue resides.  Will advise once I know more.  Evidently, there are some updates in the next release that will hopefully address and fix this issue.  In the meantime, we just need to figure out the patch to tie us over until then.

[mchamlee]

@balders-ie @eccl318 Ran into this same issue today when trying to use the 1.1.1 version of the tool. Best as I can tell, the action of publishing a flow to the server corrupts/invalidates the token. I built and successfully ran a flow from my local Designer instance. I then published successfully, but running from Gallery failed. I am the admin for our Alteryx environment so I logged into the Alteryx server itself, and opened the flow directly from the Server Gallery into Designer. Running the flow fails, but also when I click on the Tableau Output tool I am greeted immediately with a sign-in error in the tool. All the connectivity info appears correct, except for the secret, of course, which can't be validated since it's masked. If I update just the secret itself I can successfully test, connect, and then run the flow. Publishing once again results in failed runs from Gallery.

If I had to guess I'd say the publish activity isn't properly accounting for special characters in the secret portion of the token. The few I've tested with are all generated with `==:`. This is of course just a guess.

[eccl318]

What version of designer are you using.  Our issue was the python encryption was not being passed from the machine designer to gallery designer due to a registry file setting.  Once that was fixed (on both individual and server machines and all updated workflows republished - the passing occurs at publishing time, not execution time), all of our flows have worked consistently.  We have bumped into another issue of workflows failing due to "unfound URI" error (or something like that).  This can occur if two workflows are tying to connect to Tableau simultaneously.  I'm currently updating the internal table name on the Tableau tool to use a unique name (rather that 'table1') to see if that fixes the conflict.  I think you can also avoid this by using multiple tokens but I don't like that idea.

[mchamlee]

@eccl318

We're on 2021.3.2 of Designer and Server. I had seen in your earlier comment the mention of the python encryption registry file stuff, but as much as I've used python over the years it didn't ring any bells. Can you possibly provide more detail, or perhaps pass along a URL that gives an overview, for what you and your team did to implement that fix? I'm skeptical about implementing any work-around process for Alteryx functionality knowing that a change on the Alteryx side in a future release can easily break it, but if it's something perhaps we should be doing, but aren't, I'm interested in pursuing it.

I've opened a ticket with Support outlining my experiences, hoping they can provide some direct guidance or an approved fix. Right now the Tableau Output tool is a very nice to have, we desperately want to move away from user/password to PAT, but not something we're interested in rushing to implement as the tool is obviously going through growing pains. In fact, that issue with the "unfound URI" relating to simultaneous flows with Tableau Output and the relation to the tools in different flows being configured for the same PAT worries me. Our Production usage of Tableau Output will require all flows to use the same PAT attached to the Prod service account, and we're not going to create/maintain a PAT for each workflow, even if that does work around it.

[eccl318]

Our issue may have been slightly different - we were getting "Unable to resolve plugin Python 'TableauOutput_V1.1.1\main.py' at the time of publishing.  Workflow would run fine on desktop but would not publish.  Our solution was to add a the following line in the registry file.  Supposedly, 2021.4 handles this (presumably makes that change for you).

With regards to the conflicting workflows, I'm attacking first by changing the internal table name reference to something unique for each workflow.  The tool automatically gives a name in the format of #X: table1 where X is the connection number going to the tool.  I noticed that if I publish two tables in the same workflow, I'll get an error but if I rename them something different (either by changing the name or the connection number), it works fine.

[mchamlee]

Thank you @eccl318, this did indeed resolve the issue, and was also the same solution I got back from support a few hours after your post.

I appreciate your notes on the table mapping as well, and what you've seen/experienced. I'll need to do some of the same experimentation and documentation before I share Tableau Output with the rest of the team. We have several flows executed daily that publish 2 or more Hyper files to the Tableau server within the same flow. Making the point to set these names uniquely shouldn't be too much for a challenge for most users, but I'm sure others will need reminders.

[lepome]

@mchamlee 

Support is hesitant to publish registry-edit recommendations because of the risk that novices will make changes that will have wide-ranging effects.  That is usually the reason that there are not customer-facing articles on such topics.  Anyone with a valid license can open a case with Support for assistance.  That said, I applaud Community members helping each other.

[contoist]

My team has recently transitioned from the Publish to Tableau Server Tool to the Tableau Output Tool in our workflows.  It looks as if though the Tableau Output Tool cannot handle outputting large datasets.  Small datasets output to Tableau Online smoothly, however, large datasets 7GB+ cause the Tableau Output tool to error and/or crash the alteryx workflow.  Is this a known issue, and are other people experiencing this?  We can output the same data to a .hyper file and manually publish to Tableau Online, but the Tableau Output Tool is unable to handle the same data.

[eccl318]

This is a known issue.  We have submitted a case and have been informed that there are others as well that are all being combined into one case.  Hopefully will see a resolution soon.