With Tableau Desktop 2020.1 released (https://www.tableau.com/support/releases/desktop/2020.1) there are plenty of improvements and new features. But for the purpose of this blog let’s take a look at External Services the most significant change.
The change is for how secure connection is created. When configuring a connection with main menu Help, Settings and Performance, Manage External Service Connection… here’s how new configuration dialog looks like:
What is different there is no link to specify a certificate for secure connection – there’s just Require SSL option.
To compare this is how the same dialog looks in Tableau Desktop 2019.4:
How certificate validation works now is instead of comparing server (TabPy, Rserve, etc.) certificate with user-provided certificate Tableau validates the server certificate and trusts it only if it is installed as a trusted cert on the client OS or if it is signed with a trusted cert.
The server certificate can be signed with an intermediate certificate that can be signed with another certificate and so on until there’s a root certificate Tableau can trust.
For self-signed certificates (those which are not signed by any other certificate) they should be installed as trusted as well.
For how to install a certificate and make it trusted read documentation for your OS (the steps are very different for each OS).
NOTE: Rserve only sends leaf certificate and not the whole chain (there’s an issue opened for that – https://github.com/s-u/Rserve/issues/140) which makes it impossible to validate the certificate on the Tableau side unless the whole chain is installed as trusted.
Documentation for this new UI and behavior is at https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm page.
[…] to Tableau Desktop 2020.1 improvements for analytics extension (formerly referred to as external service) Tableau Server 2020.1 also presents some […]
Hi Oleksandr,Thank you for this post. I was able to fix my issues with my on-prem installation by upgrading my desktop version. However, I face the same issue with TabPy installed on a AWS machine. It fails with “cert not valid” error. However, my tableau server uses the same cert for authentication. Is there any special steps that need to be added for configuring tabpy on AWS ?
Jeevan, what exactly fails with the error – TabPy or Tableau? And what do you mean by Tableau Server uses the same cert – same as what?
Hi Oleksandr,So tableau server uses extenal SSL (in TSM under Security) and we specify a key and cert file there. So Tableau server works with those files for SSL authentication.
So i pointed my TabPy configuation file (key and cert files) to point to those same files and this fails when I start up TabPy. I’ve attached the error file.
Also this is from the Tabpy log:
2020-10-01,18:45:21 [INFO] (app.py:app:106): Web service listening on port 9004
2020-10-01,18:46:11 [WARNING] (iostream.py:iostream:1432): SSL Error on 688 (‘::1’, 57535, 0, 0): [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:1123)
PS: This is how I did for on-prem and it connected fine.
Do let me know if you need additional details.
Tableau Server doesn’t use key file for analytics extensions connection, I am not sure what it is you are talking about. Here is how how you configure Tableau Server 2020.1 connection – https://tabscifi.golovatyi.info/2020/03/tableau-server-2020-1-analytics-extensions-improvement/.
Also your screenshot is for Tableau Desktop, not for Tableau Server. For the certificate to be trusted by a machine running Tableau Desktop its root cert need to be installed as trusted. More details here – https://tabscifi.golovatyi.info/2020/07/tableau-and-trusted-certificates-for-analytics-extensions/.