Tableau to Snowflake Using OAUTH

Tableau and Snowflake are connected using an OAUTH connection. This connection allows for Tableau users to authorize a 90-day token with Snowflake, that allows them to execute queries as themselves. This approach replaces previous user impersonation through roles, and allows for cleaner and more secure data connections.

Connecting to an OAUTH data source or dashboard

When users first connect to an OAUTH protected data source or dashboard, they will be prompted to connect to Snowflake.

Users will click the “Sign in using Pitt SSO” button to be pushed through Pitt Passport. After authentication through Pitt Passport, users will need to confirm the allowed access to their Snowflake user account and role.

Once the user clicks the “Allow” button, their 90 day token will be stored in Tableau, allowing them to connect to all Snowflake OAUTH datasources without needing to re-authenticate. After 90 days, users will be required to reauthorize Tableau to connect to Snowflake on their behalf.

Users can see or clear their Snowflake/Tableau OAUTH token by visiting their “My Account Settings” in Tableau.

Creating an OAUTH data source or dashboard

Tableau data sources can be configured to connect to Snowflake using OAUTH. When a Tableau/Snowflake datasource is created with OAUTH, queries from the data source will run live against Snowflake. These connections should only be used with enterprise dashboards where row and column level security need to be applied. In other instances, please use TABLEAU@PITT.EDU along with a programmatic access token to create an extract.

Open Tableau Desktop, create a new data source, and select Snowflake. You’ll use the server address

djb69528.us-east-1.snowflakecomputing.com

Note that this address differs from the Snowflake URL you can find when logged into Snowflake.

When you click Sign In, your local browser will launch and you’ll follow the steps outlined above, authenticating to Snowflake with your Pitt account and authorizing the connection. You may note that the name of the OAUTH connection will reference Tableau Desktop.

Once you have authenticated and created a local OAUTH token, you can create your data source as required. When you publish the data source or dashboard to Tableau server, you will leave the Authentication set to “Prompt User”

The following details are documented for setup of Snowflake OAuth on Tableau Server (for communications with Tableau Server Admins, not intended for Tableau Desktop Users)

The following code created the Snowflake OAUTH connections.

CREATE SECURITY INTEGRATION OAUTH_TABLEAU_SRV
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'PUBLIC'
  OAUTH_REDIRECT_URI = 'https://analytics.pitt.edu/auth/add_oauth_token'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

CREATE SECURITY INTEGRATION OAUTH_TABLEAU_DSKTP
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = TABLEAU_DESKTOP
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

The client id and secret for the integrations (necessary for configuration on the Tableau Server) can be found by running the following command with the ACCOUNTADMIN role.

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('OAUTH_TABLEAU_SRV');

AVAAP configured the Tableau server using the Snowflake server URL above, along with the client ID and secret. This configuration is done at the site level (University). If you are attempting to set up OAUTH on another site, you will need to have OAUTH configured for it.