As you surely know, there’s much to be considered when it comes to your Tableau environment.  This is especially true for those planning a migration from Tableau Server to Tableau Cloud.  There are migration factors that apply to most Tableau environments (as Tony eloquently outlines here), and then there are considerations that are less obvious and easily overlooked as you research and prepare for your migration.

One such topic is Tabcmd.

Today we’ll talk about the implications of Salesforce’s recent multi-factor authentication enforcement, specifically as it relates to any existing or future dependencies you may have on Tabcmd.

What is Tabcmd?

Tabcmd is a Tableau-offered command line utility that enables automation of site administration tasks on your Tableau site. Historically, Tabcmd can do tasks such as:

• Uploading and refreshing extracts
• Governance, including adding/removing users, creating groups and publishing content
• Exporting views to csv, pdf or png

If you are considering a migration to Tableau Cloud, and you have or foresee a need for task automation through Tabcmd, this article will provide helpful transparency around the Tabcmd + MFA experience.

First, Some Context.

In early 2022, Salesforce announced that multi-factor authentication (MFA) would be required for all Tableau Cloud sites to further secure your data with additional approval via an authenticator app as you log in. Besides a change to the user’s login experience, this requirement also impacts the way Tabcmd logs into your Tableau Cloud site.  Whereas previously, the Tabcmd login command required a username and password to authenticate, MFA introduced the need for authentication by personal access token (PAT), to avoid a prompt for secondary approval during task automation.  However, prior versions of Tabcmd did not support PAT logins, so developers began work on what is (at least for now) the latest and only MFA-compliant version, Tabcmd 2.0.

Tabcmd 2.0 solves for the following:

• Permits authentication using PATs
• (Unrelated to MFA, yet conveniently) supports running tabcmd commands on MacOS

Tabcmd + MFA Need-To-Knows

While essential to automating tasks on your MFA-secured Tableau Cloud Site, Tabcmd 2.0 is not without its limitations (at least for now).  We find these worth mentioning so that you have the facts needed to inform your decision about whether now is the right time to either 1) migrate to Tableau Cloud given any existing Tabcmd dependencies or 2) Create new Tabcmd scripting on your Tableau Cloud site.

A few of the areas in which Tabcmd 2.0 can’t yet do what previous versions could, include:

• Extract Refreshes (refreshextracts)
  • Cannot pass the –incremental argument to perform an incremental extract refresh
  • Cannot pass the –synchronous argument to add the full refresh operation to the Backgrounder process queue
  • For environments with On-Prem data (refreshed by Tableau Bridge), the refreshextracts command sends the task to the Bridge queue but does not wait for the extract to refresh before the command line task completes. As such, this command can’t be used as an indicator or dependency for when the extract has been refreshed and may impact dependent workflows.
• Run Schedule (runschedule)
  • Not yet implemented for Tableau Cloud
• Encrypt/Decrypt/Reencryptextracts extracts (encryptextracts/decryptextracts/reencryptextracts)
  • Not yet implemented for Tableau Cloud
• Publish (publish)
  • A handful of core arguments not yet implemented for Tableau Cloud

A full list of available Tabcmd commands (and what they do!) for version 2.0 can be found here.

Where to Go From Here?

If you’re ready to press on with Tabcmd for Tableau Cloud, skip to the next section, Install the Latest Tabcmd for MFA Compliance

If you’re having reservations about adopting Tabcmd for your Tableau Cloud site or are feeling hesitant about migrating from Tableau Server to Tableau Cloud given a task automation dependency, let us make a couple suggestions.

1. Explore Tabcmd within the realm of what’s possible for now.

Tableau’s MFA requirement is relatively new, and we anticipate that more effort will soon be made towards implementing missing features in the latest version of Tabcmd as more users make the shift to securing their site with MFA.  If you’re curious about Tabcmd, or don’t utilize any of the missing functionality in your existing scripts, task automation through Tabcmd can drastically reduce your administrative overhead

2. Consider a shift to REST API Scripting (We can help!)

While Tabcmd can automate most core tasks, Tableau’s REST API offers a robust solution with more mature functionality.  To learn more about REST API click here, or “phone” a friend at InterWorks to start a conversation about how to excel your automation journey.

Ready to explore Tabcmd with MFA?  You’ve come to the right place.

Install the Latest Tabcmd for MFA Compliance

1. Download Tabcmd from this link. The first version of Tabcmd to comply with Tableau Cloud’s MFA requirement is version 2.0.  Make sure that you have downloaded the latest version of Tabcmd (or at least version 2.0) so that you can authenticate your Tabcmd login with the use of your Personal Access Token.
2.  Move the .exe file to the source directory. Unlike a typical download, there is no need to install or execute the .exe file generated from that link.  Instead, place the .exe file in the directory path from which you intend to run your Tabcmd scripts.  For example, C:\Users\myuser\Documents\Tabcmd .
3.  Generate a Personal Access Token (PAT) on your Tableau Cloud site. After logging into your Cloud site, click on your initials in the upper right corner, then choose “My Account Settings”.  Scroll down to find “Personal Access Tokens”.  Here, enter the name of your PAT and click “Create new token”.  We recommend naming your PAT with today’s date (Ex. “Tabcmd_8-22-22”) so that you know on what date it will expire (PAT’s expire after one year).  Tableau will then give you a long secret key that is necessary for authentication.  Keep this in a safe spot!
4. Open a command prompt and set your current working directory to the path where you placed your Tabcmd .exe. For example,  C:\Users\myuser\Documents\Tabcmd.  This is especially important if you have multiple versions of Tabcmd on your machine.  We want to make sure we’re running commands from that latest version, capable of authenticating with the PAT.
5. Run the tabcmd login command to login to your Cloud Site. There are some important options that we must pass to ensure successful connection to your Cloud Site.  Let’s use a sample command to break it down:tabcmd login -s https://prod-useast-b.online.tableau.com -t yoursite -tn yourtokenname -to yourtokenkey.

   -s (Server): This is the URL for your Cloud Site, beginning with “https://” and ending with “online.tableau.com”.  Reference the URL while generating your PAT above to ensure you pass the correct value into this argument.  Make sure to include the region (in the example above, that’s “prod-useast-b”.  If you don’t, you’ll get the frustrating error, “The personal access token you provided is invalid.”
   -t (Site):  How your Site should be passed for this argument.
   -tn (Token Name): This is the name of the PAT that you created in Step 3.  For example, “Tabcmd_8-22-22”.
   -to (Token Key): This is the token secret that Tableau generated upon creation of your PAT in Step 3.  We moved this to a safe spot, so locate it there.

If you’ve passed all arguments correctly, you’ll see a happy “Succeeded” output from your command line.  Reference the tabcmd Commands documentation to perform other tasks.

Note that if you’re seeing an output containing a Proxy Error, you may need to add “*online.tableau.com” to the exceptions list on the machine you’re using to run the script.

That’s All for Now!

We hope that this post has helped shed some light on Tabcmd + MFA, and we’d love to support your automation efforts moving forward.  Don’t hesitate to drop us a line, and happy scripting!