Unable to get server to connect to Tableau online using PAT

[craigja]

Hi,

We are moving over to Tableau online and they have now enabled MFA, as a result we are trying to connect using PATs (Personal Access Tokens). Im struggling though - I can create a PAT and in Designer on my local machine, connect to Tableau online and it all works fine - I can create a datasource etc.  If I then save that to the server and run from there it fails: Failed to signin to Tableau.  In order to get this far I had to export our certificates from the link below, prior to following this I got the same error as the server does.  I have on the server done the same steps as on my machine, copying the cacert.pem file thats working on my machine to the server in the C:\ProgramData\Alteryx\Tools\Tableau_v1.1.1_venv\Lib\site-packages\certifi folder.  The server has also been upgraded to 2021.4 and Im running 2021.4 as well.

Where it gets really strange is that one of our server admins can run it ok on the server.  If he creates a workflow on the designer instance on the server and tests it with his PAT it works, if he then saves that to the sever and on his PC opens the gallery and runs that workflow it works fine.  If we do the same steps he does on my machine it runs locally but not on the server.  If I use his PAT on my workflow it wont work but will work if he uses it.  We are completely out of ideas as to why this wont work!  It cant be a firewall/certificate issue as we can get a workflow to run on the server.  It cant be a PAT issue as I can get a workflow to run locally!  Im out of ideas, has anybody got any ideas?

https://community.alteryx.com/t5/Alteryx-Designer-Knowledge-Base/Connection-Errors-with-Python-based...

[Mac-Sawyer]

I'm in the exact same situation except we are on 2021.3 which is the minimum needed to use this solution.

We have additionally tried what was mentioned in this thread: Solved: error while saving workflow in Gallery: RuntimeErr... - Alteryx Community

The registry change to both the machine publishing and the gallery server. Our initial test of this last night didn't work out and we got the same connection error on server. I'm planning on doing a little more testing though to verify. I might restart things just to make sure, double check the registry settings, etc. 

As I understand it though, it's not got a chance of working without this.

Let me know if you have a breakthrough and I'll do the same.

[craigja]

I dont have any errors when saving, its purely when I run it from the server that we get this issue - we found another version of the tool on a community page and that seems to work. I will ask the guys to give me a link to it so I can provide it here.  I have no idea why this version works and as its a community one you may not want to use it in produciton!

[Mac-Sawyer]

Same here, I have no issues saving the workflow to Server. However, this was given as a possible solution to the gallery connection error. I look forward to taking a look at that tool, but i agree that it would be tough to deploy that to prod and count on.

[Mac-Sawyer]

Posting a follow up to this as we finally got it sorted out. For us, this did not originally look like a proxy issue. We could run the workflow in designer on the server using the same SA account it was running with under Gallery. However, though a lot of digging and trying various things, I finally determined we needed to add the SA credentials into the Proxy setup of Gallery. Once we did that, it's working fine for us.

[Alejandro_Murillo]

Hi @Mac-Sawyer 

I'm experiencing the same. Can you please confirm where exactly you configured the credentials?

I checked the Alteryx server configuration based on the information below and the Proxy settings tab is not visible in the "Engine" section.

https://help.alteryx.com/20221/designer/system-settings#:~:text=A%20proxy%20can%20also%20be,and%20se....

[Abhinav_Pathak]

Hi Ale,

Could you please save Tableau Online Certificate on Tableau Output Tool?

This Link shows an example for Connect however for Tableau Output Tool, you can export the certificate from Tableau Online URL and Copy Certificate entry as Text.

Then, append the certificate entry in the CACERT.pem file (at the below location) for the Tableau Output tool for the user account which is being used as RUN-AS Service Account in Alteryx Server. You have to do this step on all Alteryx Server Nodes.

Location for CACERT:

For Admin Account : Goto Location C:\ProgramData\Alteryx\Tools\TOOLNAME\Lib\site-packages\certifi\cacert.pem

For Other Users: Goto Location C:\Users\USERNAME\AppData\Roaming\Alteryx\Tools\TOOLNAME\Lib\site-packages\certfi\cacert.pem

This will allow Alteryx Server to connect to Tableau Online via the tableau output tool and workflow should run well. If it is failing on a specific node then you should troubleshoot on that node for other factors.

Regards,

Abhinav Pathak

[Alejandro_Murillo]

Issue resolved with below steps.

Create key on local user machines and Alteryx server nodes
Administrators will need to create a new string value PythonAllowHideEncryption under the Alteryx Registry Key:

Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SRC\Alteryx
Value Name: PythonAllowHideEncryption
Value Data: true
Note: This key must be set on each user’s machine as well as on all Worker nodes.

Steps to create the new key:
Type regedit in Windows Start Menu
Browse to the folder location: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SRC\Alteryx
Right-click and select New > String Value

[compass]

SOLUTION FOUND!

In case anyone else finds themselves on this thread after banging their heads against the wall trying to figure out why Tableau Output Tool works locally but not on the Server.

Got it working with:

- Designer + Server 2022.3

- Tableau Output tool v1.2.0

Key Configurations:

- You must have DCM SDK set to "Allow All" on the Server machine (screenshot below)

- Workflows must be connecting to Tableau with a DCM connection that is synchronized both on your local machine and the Server. The DCM Data Source must be linked to a Credential that uses the personal authentication token (PAT).

- Note: to synchronize, I went to File > Manage Connections > Synchronize > selected my Gallery > then pressed "Synchronize" in the top-right corner. The sync was bilateral, meaning local DCM sources went to the Server, and Server DCM sources came down to my local machine.

No modifications to registries necessary.

Came across this all here after doing more digging than I'd like to admit.

If you click under the latest Tableau Output tool version (1.2.0, at the time of this writing), you'll see these details listed, along with the current Known Issues.

Not sure what future versions will look like, and not entirely sure on what the security considerations are for setting Allow All on SDK Tools support, but it got the job done for now.

Hope this helps.

[Propel32_]

Hi this is super helpful, thank you. Can I ask - will this only work if you have an Alteryx Gallery set up? I tried to Enable Gallery but it defaults to a MongoDB database which our organization doesn't have access to. Do you know if there's any other way around this?