Enhancement request: Add support for embedding snowflake key pair authentication credentials in data sources #1573

Activity

1. george-prg

   added

   enhancement

   needs investigationIssue needs to be looked at by TableauIssue needs to be looked at by Tableau

   on Feb 17, 2025
2. yggcrandall commented on Apr 24, 2025

   

   yggcrandall

   on Apr 24, 2025

   More actions

   Yes please. or at least put it in the REST API for publishing a data source. username/password, and oauth are there, why not keypair?!?!?!
3. jrbasso commented on Mar 11, 2026

   

   jrbasso

   on Mar 11, 2026

   More actions

   This will be great, especially this year since Snowflake is dropping the legacy service accounts.
4. Nagendra4919-tech commented on Apr 25, 2026

   

   Nagendra4919-tech

   on Apr 25, 2026

   Last edited by Nagendra4919-tech

   More actions

   Tableau Promotion Strategy (DEV → PROD with Snowflake Keypair Authentication)
   Objective
   • Developers use OAuth for development
   • Production uses Snowflake Service Account (Key-Pair)
   • No key-pair credentials are shared with developers

   ---

   1. Manual Process (Current Approach)
   Workflow:
   Developers (Snowflake OAuth in Desktop)
   ↓
   Publish to Tableau Server (DEV)
   ↓
   Admins download Datasource/Workbook from DEV
   ↓
   Admins modify authentication to Key-Pair (Service Account)
   ↓
   Publish to PROD
   ↓
   Assign Server Saved Credentials
   ↓
   Production Ready (Service Account + Keypair)

   ---

   Explanation
   • Developers build in Tableau Desktop using:
   Snowflake OAuth (their own login)
   • Publish to DEV Tableau Server
   • Admin team:
   Downloads (.tdsx / .twbx/.twb/.tds)
   Updates connection:
   OAuth → Key-pair authentication
   • Publishes to PROD
   • Selects: Server Saved Credentials

   ---

   Limitations of Manual Process
   • Time-consuming
   • Error-prone
   • Not scalable
   • Requires repeated admin effort

   ---

   2. Automated Process (Recommended Approach)
   Workflow:
   Developers (Snowflake OAuth in Desktop)
   ↓
   Publish to Tableau Server (DEV)
   ↓
   Developer confirms for PROD deployment
   ↓
   Automation Trigger (Service Account)
   ↓
   Download Datasource/Workbook from DEV (REST API)
   ↓
   Modify XML (OAuth → Key-Pair Authentication)
   ↓
   Publish to PROD (REST API)
   ↓
   Assign Saved Credentials (VizPortal API - Keychain Entry ID)
   ↓
   Production Ready (Service Account + Keypair)

   ---

   Automation Logic (What Script Does)
   Using Tableau REST API and VizPortal API:

   1. Download from DEV Tableau Server
      • Fetch datasource/workbook package
      • Extract XML (TDS/TWB)
   2. Modify Authentication
      • Replace: OAuth configuration With Key-pair authentication settings in XML and repack the XML.
      ⚠️ Important:
      • No private key is embedded
      • Only connection type is updated

   ---

   3. Publish to PROD
      • Upload updated content via REST API

   ---

   4. Assign Saved Credentials
      • Use VizPortal API to assign:
      ✅ Keychain Entry ID
      This ensures:
      • Tableau uses server-stored service account credentials

   ---

   Key Security Design
   Why This Is Safe
   • 🔒 Private key is NEVER:
   o Shared with developers
   o Stored in files
   o Embedded in XML
   • 🔒 Credentials exist only in:
   Tableau Server Saved Credentials (Keychain)

   ---

   Critical Requirement
   Automation MUST run using a dedicated service account
   Because:
   • Saved credentials are tied to the account executing the script
5. jacalata

   added

   Server-Side Enhancement

   on Jun 18, 2026
6. mukunda-xing commented on Jul 15, 2026

   

   mukunda-xing

   on Jul 15, 2026

   More actions

   @Nagendra4919-tech does your solution, especially no.4, Assign Saved Credentials work for Tableau Cloud also?
7. jacalata

   added

   ui-existsFunctionality is available in the Tableau UI but not yet in the REST APIFunctionality is available in the Tableau UI but not yet in the REST API

   on Aug 25, 2026