Important: This document is only useful if you are using a Tableau version older than 2023.1. For Tableau versions 2023.1 or newer, you can take advantage of the OAuth support integrated in the last Denodo JDBC connector. The process is described in the How to configure OAuth authentication in the Tableau Denodo JDBC connector article.

Overview

The Tableau connector SDK provides limited support for OAuth authentication, which makes it very difficult to develop a connector that could work with different identity providers and environments.

In this document we will provide guidelines to make the required changes in the Denodo connector for Tableau to support OAuth authentication with an identity provider.

Getting the connector code

The last published connector can be downloaded from the Tableau Extension Gallery.

• Select the ‘Denodo JDBC’ connector.
• Click on the ‘Download’ button.

You will get a .taco file with .taco(similar to zip) containing the connector's source code.

• Extract the connector's source code using any application to unzip files.
• The following files are included:

• manifest.xml
• connectionFields.xml
• connectionMetadata.xml
• connectionResolver.tdr
• connectionBuilder.js
• connectionProperties.js
• dialect.tdd
• resources-en_US.xml
• resources-es_ES.xml

Change the connector to support OAuth authentication

1. Apply the following patch in the source code folder: denodo_jdbc_oauth.patch
2. Create a file called oauthConfig.xml with the following content. Modify the content to fit the configuration for the identity provider used:

How to configure oauthConfig.xml file.

The different parameters in this configuration file need to be adapted to the identity provider being used. In this section we will explain the different parameters with a focus in Azure AD.

The values of the these properties could be re-defined in Tableau server, but Tableau desktop will use the ones defined in this file (See Config OAuth client on Tableau server):

• ‘clientIdDesktop’
• ‘clientSecretDesktop’
• ‘redirectUrisDesktop’

The authorization and token endpoints will be obtained by concatenating the value established in the OAuth instance URL field (in the connection dialog) and the values retrieved from the ‘authUri’ and ‘tokenUri’ properties in the oauthConfig.xml file.

The property instanceUrlValidationRegex can be used to validate the OAuth instance URL provided by the user (this is an optional parameter that can be omitted).

The property scopes can be included several times to define the scopes that will be included in the OAuth request.

• It is recommended to include ‘openid’ and ‘offline_access’ for Azure AD.

The capabilities section of the file defines the behavior of the connector to retrieve the access token, refresh token and user name (see OAuth config file for more details).

• The OAUTH_CAP_SUPPORTS_GET_USERINFO_FROM_ID_TOKEN capability should be set to true in order to retrieve the user name from the access token instead of using a request to the userInfo endpoint.

The accessTokenResponseMaps section defines:

• Which attributes from the OAuth response include the access token, refresh token and id token.
• Which attributes from the access token include the time when the token was issued and its expiration date.
• Which attribute from the id token contains the user name.

• This is important because Tableau will use this value to store all the retrieved information for this specific user.

Authentication flow

Any connector developed with the Tableau SDK will use the OAuth authentication flow and the following authentication path will be followed.

• [Optional]The connector will validate the OAuth instance URL with the regular expression defined in the ‘instanceUrlValidationRegex’ property if it was defined.
• The authorization and token endpoints will be calculated using the value provided in the OAuth instance URL field and the values defined in the ‘authUri’ and ‘tokenUri’ properties.

• If the value of the OAUTH_CAP_SUPPORTS_CUSTOM_DOMAIN property is set to false, the value of the properties will be used without concatenating the value provided by the user.

• To build both requests (authorize and token), the connector will use the information defined in the following properties:

• clientIdDesktop
• clientSecretDesktop
• redirectUrisDesktop
• scopes
• capabilities.OAUTH_CAP_REQUIRE_PKCE
• capabilities.OAUTH_CAP_PKCE_REQUIRES_CODE_CHALLENGE_METHOD
• capabilities.OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL
• capabilities.OAUTH_CAP_SUPPORTS_STATE

• Once the OAuth response is retrieved, the connector must get the username.

• If OAUTH_CAP_SUPPORTS_GET_USERINFO_FROM_ID_TOKEN capability is true, the username will be retrieved from the id token.
• Otherwise, a new request for the user info endpoint will be sent and the username will be retrieved from the response.

• The value of the ‘userInfoUri’ property (which is optional and not defined in this example) will be used for this request.

• In both cases, the value defined for accessTokenResponseMaps.username will be the attribute which should include the user name (in the id_token or in the userInfo response).

Package the connector

To sign and package the connector you can follow the instructions provided on the Tableau connector SDK documentation page: Package and Sign Your Connector for Distribution .

Install the connector

For more information see: Run Your Connector (tableau.github.io)

Place the.taco file in the following locations:

Tableau Desktop:

Tableau Server:

The packaged file must be signed, if using an unsigned one, you have to configure Tableau to skip the signature check.

Tableau Desktop:

Tableau Server:

Create a folder called "denodo_jdbc" under C:\Program Files\Tableau\Drivers\denodo_jdbc and place there the Denodo JDBC driver and the libraries jna.jar and jna-platform.jar that can be found under <DENODO_HOME>\lib\contrib.

Test the connector

OAuth authentication Test

To test the OAuth authentication with the new connector:

• Open the Denodo data source connection dialog.
• Select ‘OAuth authentication’ in the ‘Authentication’ field.
• Set ‘OAuth instance url’ to the identity provider instance URL.
• Click on the ‘Sign in’ button.