Enhancement request: Add support for embedding snowflake key pair authentication credentials in data sources

[george-prg]

Description

I want to embed key pair authentication credentials after publishing a Snowflake-connected data source to Tableau Cloud using Tableau Server Client.

[yggcrandall]

Yes please. or at least put it in the REST API for publishing a data source. username/password, and oauth are there, why not keypair?!?!?!

[jrbasso]

This will be great, especially this year since Snowflake is dropping the legacy service accounts.

[Nagendra4919-tech]

Tableau Promotion Strategy (DEV → PROD with Snowflake Keypair Authentication)
Objective
• Developers use OAuth for development
• Production uses Snowflake Service Account (Key-Pair)
• No key-pair credentials are shared with developers

---

1. Manual Process (Current Approach)
Workflow:
Developers (Snowflake OAuth in Desktop)
↓
Publish to Tableau Server (DEV)
↓
Admins download Datasource/Workbook from DEV
↓
Admins modify authentication to Key-Pair (Service Account)
↓
Publish to PROD
↓
Assign Server Saved Credentials
↓
Production Ready (Service Account + Keypair)

---

Explanation
• Developers build in Tableau Desktop using:
Snowflake OAuth (their own login)
• Publish to DEV Tableau Server
• Admin team:
Downloads (.tdsx / .twbx/.twb/.tds)
Updates connection:
OAuth → Key-pair authentication
• Publishes to PROD
• Selects: Server Saved Credentials

---

Limitations of Manual Process
• Time-consuming
• Error-prone
• Not scalable
• Requires repeated admin effort

---

2. Automated Process (Recommended Approach)
Workflow:
Developers (Snowflake OAuth in Desktop)
↓
Publish to Tableau Server (DEV)
↓
Developer confirms for PROD deployment
↓
Automation Trigger (Service Account)
↓
Download Datasource/Workbook from DEV (REST API)
↓
Modify XML (OAuth → Key-Pair Authentication)
↓
Publish to PROD (REST API)
↓
Assign Saved Credentials (VizPortal API - Keychain Entry ID)
↓
Production Ready (Service Account + Keypair)

---

Automation Logic (What Script Does)
Using Tableau REST API and VizPortal API:

1. Download from DEV Tableau Server
   • Fetch datasource/workbook package
   • Extract XML (TDS/TWB)
2. Modify Authentication
   • Replace: OAuth configuration With Key-pair authentication settings in XML and repack the XML.
   ⚠️ Important:
   • No private key is embedded
   • Only connection type is updated

---

3. Publish to PROD
   • Upload updated content via REST API

---

4. Assign Saved Credentials
   • Use VizPortal API to assign:
   ✅ Keychain Entry ID
   This ensures:
   • Tableau uses server-stored service account credentials

---

Key Security Design
Why This Is Safe
• 🔒 Private key is NEVER:
o Shared with developers
o Stored in files
o Embedded in XML
• 🔒 Credentials exist only in:
Tableau Server Saved Credentials (Keychain)

---

Critical Requirement
Automation MUST run using a dedicated service account
Because:
• Saved credentials are tied to the account executing the script