Automated Partner Access Provisioning to Tableau Dashboards using Alteryx and Tableau API

[ShshankChawathay]

Name: Shshank Chawathay

Title: Analytics Lead

Company:Juniper Networks Inc.

Collaborators: Brian Calvanese, Amanda Baranauskas

 

Overview of Use Case

Juniper Networks Inc. went live with their partner facing Tableau dashboards to enable Partners for tracking their Services performance. As a part of the release, one of the challenges was; creating a process to give entitled Partner Contacts secure access to these dashboards and making it seamless by integrating it with Juniper’s Partner Center. These contacts are provided by the Services Partner Managers (SPMs).

Describe the business challenge or problem you needed to solve

Now, one would think this is a simple problem to solve, just create a list of Partner Contact emails and Partner ID’s that would require access, authenticate them using Single Sign On (SSO) from Partner Center to Tableau Online and the built-in security of the dashboard will take care of the rest. Moreover, it would have been, but for these two issues

1. Partner Contacts are employees, subject to move from one employer to another and thus these contacts need to be validated continuously. This validation used to be done manually by tallying up data between the Partner Center and a spreadsheet.
   
   
2. Every time you need to add users to Tableau Online, the way Junipers Tableau Online site was structured, it would require every user to be authenticated for SAML, assigned a site role and assigned to a group manually. For deletion, you would have to manually search for specific email IDs/users and delete or un-assign them.

This entire process took one resource at least a couple of hours per week if the Partner Contacts are validated once a week. It also created a few loopholes concerning data security arising from manual errors and timing. For instance, what if the partner contact has left the partner and still has access to the dashboards and consequently to confidential data.

These concerns gave rise to the following business questions:

• How do we consistently validate the existing Partner Contacts before provisioning access?
• How to create an efficient process to add new and delete invalid partner contacts to/from Tableau?
• How can we automate this mundane and cumbersome process?

Figure 1 The Partner Contact Validation and Access Provisioning Process (Old)

 

Describe your working solution

Alteryx came to the rescue. We created a 2-step process using Alteryx Designer and Server.

STEP 1:  We create a Master Data file of Partner Contacts by extracting data from the Credential Management System (Oracle Database) that authenticates users in the Partner Center and feeds the IDP and SP using SAML 2.0. This Master Data for Partner Contacts is then used to cross-reference the Partner Contacts provided by Juniper’s Services Partner Managers (SPMs). All the contacts thus validated are pushed to a Staging File, and the ones that are invalid are kicked back to the respective SPMs for due diligence.

STEP 2:

The Staging File created in STEP 1 is then used to validate existing users on Tableau Online site using Tableau API 2.3. Post validation, one stream of workflow adds multiple valid users to the site as interactors and their respective group. Another stream takes all the pre-existing invalid users and deletes them from the site. Both of these actions are performed by a combination of download tools and dedicated batch macros specially designed for this use case.

Figure 2 The Partner Contact Validation and Access Provisioning Process (New)

These two steps are performed in tandem by Alteryx server on a daily schedule for upkeep and maintenance of Partner Contacts on Tableau Online site.

Key Tools Used:

Download

For Connecting to Tableau Online using API 2.3 to perform POST and GET calls for addition, deletion and assignment of users

XML Parse

For Parsing the XML from download tool into plain text format. Simplifies understanding of the action performed by the tool as well as enables the use of authorization tokens and URLs in downstream tools.

Formula

For creating/modifying URLs for API calls and passing authorization tokens downstream.

Input

Connecting to Oracle Database for retrieving the Partner Contacts Master Data.

Describe the benefits you have achieved

Let’s begin with answering the business questions we framed initially:

• How do we consistently validate the existing Partner Contacts before provisioning access?
  • The solution handles this very elegantly by not only validating the new users with the master data but also the existing users on Tableau Online to securely provide access only to valid Partner Contacts.
• How to create an efficient process to add new and delete invalid partner contacts to/from Tableau?
  • Tableau API and Alteryx Download tool are like a match made in heaven. We use this perfect combination to perform tasks of batch addition/deletion of users to the site. This has saved us at least 2hr/week worth of time which can now be spent on coming up with innovative solutions to new challenges.
• How can we automate this mundane and cumbersome process?
  • Scheduling daily runs of the workflow on Alteryx server has essentially created a fully automated process which needs no manual intervention. We have also built in email alerts which tell us how many users were added/deleted in each run apart from notifying about the status of the workflow.

This solution has enabled us to create an entirely hands-off process for the maintenance of access provisioning for our external partners. Nothing of this sort has been done at Juniper before. There a several menial tasks that an analyst or a data scientist must perform on a day-to-day basis, this solution eliminates at least one of such tasks. It makes me wonder how many analysts using Tableau Online like us are suffering the way we used to before we developed this workflow. I hope this solution inspires them to build something similar for their specific use case if not adopt this solution and make the most of Alteryx’s remarkable capabilities.

Although this might feel like a  small step towards building large-scale automated processes, I think it is a big step in the right direction.