## Set up Tableau URL: https://docs.atlan.com/apps/connectors/business-intelligence/tableau/how-tos/set-up-tableau > :::warning Who can do this? You probably need your Tableau administrator to run these commands - you may not have access yourself. :::warning Who can do this? You probably need your Tableau administrator to run these commands - you may not have access yourself. ::: ## Tableau metadata API To enable the Tableau Metadata API, follow the [steps in Tableau documentation](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_start.html#enable-the-tableau-metadata-api-for-tableau-server). :::warning Atlan needs the Tableau Metadata API to crawl metadata. Verify you're running the latest version of Tableau Server or Tableau Online (2022.x with REST API version 3.14+). Learn more about the [permissions](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_permissions.html) used to access metadata through the Tableau Metadata API. ::: ## Publish worksheets you want to crawl Verify you publish the worksheets in Tableau that you want to crawl in Atlan. To publish Tableau worksheets, follow the [steps in Tableau documentation](https://help.tableau.com/current/pro/desktop/en-us/environ_workbooksandsheets_sheets_hideshow.htm). ## Choose authentication mechanism Atlan supports the following authentication methods for fetching metadata from Tableau: - [Basic](#basic-authentication) - this method uses a username and password. - [Personal access token](#personal-access-token-authentication) - this method uses a personal access token. - [JWT bearer](#jwt-bearer-authentication) - this method uses a username and JWT client ID, secret ID, and secret value. ### Basic authentication :::info **Did you know?** To crawl assets and extract asset lineage from Tableau, the user must have the [_Site Administrator Explorer_ role](https://help.tableau.com/current/online/en-us/permission_license_siterole.htm). Atlan requires the _Site Administrator Explorer_ role in Tableau to extract data source fields and calculated fields and create field-level assets and lineage. It's not possible to fetch either with the _Viewer_ role in the current version of the Tableau Metadata API. ::: #### Add user Verify you add a user with the role _Site Administrator Explorer_ to the site you want to crawl. To add such a user, follow the [steps in Tableau documentation](https://help.tableau.com/current/server/en-us/sites_addusers.htm). #### Grant user permissions Verify you grant the [_View_ capability](https://help.tableau.com/current/online/en-us/permissions_capabilities.htm#capabilities) for all the assets you want to crawl. To grant the permission, follow the [steps in Tableau documentation](https://help.tableau.com/current/online/en-us/permissions.htm#set-permissions). ### Personal access token authentication If you want to access Tableau using an access token, you can generate a personal access token. To generate a personal access token, follow the [steps in Tableau documentation](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm). :::warning Use one Personal Access Token per concurrent workflow A Tableau PAT supports only one active session at a time. If you run multiple Tableau workflows (or crawls) at the same time using the same PAT, each new sign-in terminates the previous session, causing the running workflow to fail with authentication or unauthorized (401) errors. To run Tableau workflows in parallel, use a dedicated PAT per workflow, or schedule them to run sequentially so they don't overlap. See [Tableau's documentation on Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) for details. ::: ### JWT bearer authentication :::warning To access the [Tableau Metadata API using JWT bearer authentication](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_auth.html#sign-in-using-a-json-web-token-jwt), you must have Tableau Cloud October 2023 or Tableau Server 2023.3 version. In addition, JWT authorization currently doesn't support all [REST API capabilities](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm#scopes). Due to these limitations at source, Atlan can't crawl [Tableau flows](https://docs.atlan.com/llms/connectors/tableau/what-does-atlan-crawl-from-tableau/llms.txt) or populate [Tableau popularity metrics](https://docs.atlan.com/llms/connectors/tableau/view-based-popularity-metrics/llms.txt) if you use the JWT bearer authentication method. To enable popularity, use [personal access token](#personal-access-token-authentication) or [basic authentication](#basic-authentication) instead. ::: #### Configure connected app If you want to access Tableau using a JSON web token (JWT), you can configure a Tableau connected app. To authenticate the Tableau connection in Atlan using this method, you need the following: - Username - your Tableau Server username or Tableau Online email address, the user must have a [_Site Administrator Explorer_ role](https://help.tableau.com/current/online/en-us/permission_license_siterole.htm) - Connected app ID - client ID generated for the connected app - Secret ID - secret ID linked to the client ID of the connected app - Secret value - secret value used to sign the token To configure a connected app, follow the steps in Tableau documentation: - [Direct trust](https://help.tableau.com/current/server-linux/en-us/connected_apps_direct.htm) #### Access scopes for connected apps For JWT authorization, [scopes](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) define access permissions granted to the token holder. Scopes control the specific actions that an application or user can perform in Tableau while accessing content through a connected app. The Tableau connector in Atlan uses two `read` scopes to extract metadata from Tableau. Note that the Tableau connector is preconfigured to use these scopes, no action required. Atlan uses the following scopes for JWT authentication: - `tableau:content:read` - permits read access to your assets in Tableau, including: - Workbooks - can list, access, and retrieve metadata for workbooks. - Views - can fetch specific views or dashboards within workbooks. - Data sources - can access published data sources and associated metadata. - Projects - can retrieve project metadata. - Metrics - can read metrics associated with workbooks or dashboards. - Tables and databases - can access metadata for tables and databases connected to Tableau. - `tableau:users:read` - permits read access to user details. This enables Atlan to display the source owner property for supported Tableau assets, including in the [impact analysis report](https://docs.atlan.com/llms/catalog/lineage/download-and-export-lineage/llms.txt). - (Optional) `tableau:workbooks:download` – permits downloading a workbook (`.twb` or `.twbx`), enabling Atlan to display relationships for embedded Tableau dashboards. The following table lists what Atlan's JWT scopes permit. | Action | Scope | Included | |---|---|---| | Read workbook and data source metadata | `tableau:content:read` | Yes | | Read user details | `tableau:users:read` | Yes | | Download workbook files (.twb / .twbx) | `tableau:workbooks:download` | No (optional) | | Download raw view data (CSV / Excel) | `tableau:views:download` | No | | Modify or delete any Tableau content | Write or delete scope | No | | Query underlying data via VizQL Data Service | `tableau:viz_data_service:read` | No | :::info Atlan doesn't include `tableau:viz_data_service:read`, so querying underlying data via VizQL Data Service isn't available when using JWT authentication. ::: ---