Tableau Server

PowerPoint Template Find and Replace in Behold! Emailer 2.1 Beta 1

A long time request I’ve heard from customers is the need to update the images of Tableau Server vizes within a PowerPoint presentation. Behold! Emailer 2.1 now includes a tab for doing this type of “find and replace” on an existing PowerPoint (PPTX) presentation file. You specify the slide and the location of the viz you’d like to pull, and the tool will download that image, insert it into the PPTX file, and replace whatever other image was previously on that slide. It should be a real time saver for those who have to do this type of activity regularly.

The instructions for using it are all in the README , including the caveat that this is only for slides that have a single image in them currently. Please let me know if you have any issues or other requests around this use case.



Behold! Emailer 2.0 Beta 1 Available

After a long pause in development, the first Beta of Behold! Emailer 2.0 is now available for testing on GitHub, in a new repository. For a full overview, please see the new README . Here is the quick description:

  • Complete redesign of the interface, separating configurations from the actions, with an Activity Log to show the progress of your actions and any running schedules
  • Queuing system for all actions. You can trigger off individual file exports, start a batch export run all while it continues to run the scheduled e-mails from Tableau Server.
  • Vastly improved README file
  • Single and Batch e-mail modes allow for specifying the type of file export: fullpdf, pdf, png or csv
  • Tested up to Tableau Server 2018.1
  • Full code review internally to clean up and use modern C# best practices
  • Upgraded Npgsql package in the binary release for better stability

It’s just a Beta 1 because I need feedback on any errors or issues, but it is already much improved and more stable than any of the old 1.2 versions.

Session-level Single-Sign On

Tableau Server doesn’t currently (as of 2018.2) have a dedicated “service” for authentication when doing Single Sign-On. Instead, a Tableau Server session is established the first time you load a Viz using a given SSO method. Whether using Trusted Authentication, Windows Authentication, or SAML, when the first viz loads, that is when the authentication actually happens, and after that point, there is a Tableau Server session cookie, so that the authentication doesn’t have to happen continuously.

Traditionally, particularly for Trusted Authentication, instructions have been given to request and send a new ticket for each load of any Viz. But this introduces extra, unnecessary authentication requests, and can even lead to a “race condition” when you are loading multiple Vizes in the same page, where sessions are being created and overriding each other as separate tickets are processing at the same time. This same issue can affect ANY of the SSO methods when loading multiple vizes.

The Hidden / Empty Viz Solution

As mentioned above, once the first Viz has been authenticated, there is a Tableau Server Sesssion cookie that will be used for all subsequent requests. So to create a “login” service, we simply need to login as quickly as possible to a Viz. This is very similar to what you need to do for Trusted Authentication SSO into the full Tableau Server UI.

The simplest Viz possible is all we need (literally, a single filter on a page using a totally blank Data Source can be used). Every user is the Tableau Server should have access to this Viz. As soon as the user is authenticated into the main application, you should load the simple viz — if using Trusted Authentication, this request should include the trusted ticket. You can hide the Viz div under something or out of sight (the div shouldn’t actually have visibility:hidden though because some browsers don’t like that prior to the Viz being initialized), so that the user doesn’t see this load process. Or do it quickly in a page that then redirects to the next page. It’s up to you.

Session Timeout with Trusted Tickets

The one advantage of continually sending Trusted Tickets is that the Tableau Server session is continually extending as each ticket is sent. If you only do one Trusted Ticket to establish a session, how do you keep from timing out and sending the user to the Tableau Server sign-in box? The answer is to set your own timer cookie, and whenever it times out, reestablish the session using the Empty Viz. You shouldn’t need to do this with SAML or AD, because they will automatically call out and reestablish their sessions, but you could.


Tableau Server sessions will end naturally based on the value you have set for them using tabadmin / TSM. Actually forcing a Tableau Session to sign-out is a little tricky — recent versions of Tableau Server understand a SAML IdP Signout, or you could try to use the REST API to signout, but in the latest version of Tableau Server, the REST API technique requires reverting to a simpler, less secure type of session cookie.

Revisiting The Tenets of Multi-Tenancy

Since there’s been so much time and better examples and code, I went back and did a major revision of the The Tenets of Tableau Templates on Multi-tenants which I highly advise everyone reading. It’s the most thorough explanation out there of how to correctly handle SaaS / Multi-Tenancy or Dev->Test->Prod promotion. And no, you do not need Interworks PowerTools to do this process, although they do have some nice features.

tableau_tools 4.0.0 is released!

I’m very excited to announce the release of tableau_tools 4.0.0, available now on GitHub and PyPi! tableau_tools is a single library to make administrating a Tableau Server and the content on that server as simple as possible. It is written in Python 2.7 with the aim to eventually become compatible with Python 3. It is also intended to server all versions of Tableau Server from 9.0 – current release.

The 4.0 release is almost a complete rewrite, with a focus on full implementation of the Tableau Server REST API through API Version 2.6, simplification of methods throughout, and advanced capabilities for publishing from templates. The capabilities of tableau_tools are beyond the current capabilities of the Tableau Server-Client Library and Document API, and I recommend you use it over them at this time.

4.0 is different enough from the previous versions that all previous versions of tableau_tools are now deprecated, and I will be removing their documentation from the website to remove any confusion.

There are plenty of example scripts included in the package, which you can see at GitHub…

The README is a full guide to using the library, and should be read when beginning. As before, tableau_tools was programmed using PyCharm and is designed to provide optimal code completion when using PyCharm. Your life will be a lot easier if you do.

tableau_tools README

A list of all the major changes, which won’t matter if you are just getting started:


Triggering Extract Refreshes with tableau_tools

If you have ETL processes that must run before your extracts can generate, it may make more sense to trigger an extract refresh (or the schedules) to run after the ETL has finished, rather than setting the extracts on a schedule. It maximizes your backgrounder processes by feeding their queues immediately when data is ready, and saves wasted effort if the ETL process fails.

As of Tableau Server version 10.0, there are no REST API commands to do this triggering, but tabcmd does have commands that can accomplish this. The tableau_tools Python library  has a Tabcmd class that wraps the most common tabcmd commands, including those for extract refreshes. Together with the tableau_rest_api sub-package, you can trigger off extract refreshes.

Note: Please use the latest version of tableau_tools (3.1.0+) to do the following.


Using IPsec to Encrypt Tableau Server Intra-node Communication

If you want to run Tableau Server in a cloud hosted environment, like AWS, you may have concerns about unencrypted traffic between the nodes of the Tableau Server. Of course, you will have configured the Tableau Server to use SSL for external communications, and configured the internal repository to communicate via SSL, but what about data server, the data engine, etc.?

The best method to protect all of that communication is to enable IPsec via the Windows Firewall with Advanced Security pane in the Administrative Tools of Windows Server. I’m no expert on these things, so any questions, comments or discoveries are very welcome, but this seems to work in a basic AWS test cluster. I’ve heard you can control all of this policy stuff from a domain controller rather than configuring each machine, so don’t take this as the only way to configure IPsec.