Skip to content

Commit 3cc5eb0

Browse files
anyoung-tableauCopilot
anyoung-tableau
and
Copilot
authored
Add OAuth support (#156)
* Add OAuth config entries (#142) * Add OAuth config variables * Update ProcessEnv * Add test for clientIdSecretPairs * Clean up * Fix bad merge, address copilot suggestion * A few housekeeping things (#143) * Update lint rules * Use 127.0.0.1 for local http * Fix lint errors * Upload docs artifacts * Add API definitions (#144) * Add Tableau OAuth Zodios definitions * Add Get Current Server Session REST API * Update import * Add OAuth 2.1 implementation (#145) * Add OAuth 2.1 implementation * Remove scope from access token * Apply suggestion from @Copilot Co-authored-by: Copilot <[email protected]> * Fix expiration of access token generated from client creds * Add clientId to token * Treat Tableau access token expiry in seconds * Treat all timestamps in seconds * Rotate the refresh token * Generate new code verifier for Tableau * Add auth middleware (#147) * Add auth middleware * Add clientId in access token * Remove extraneous variable * Treat Tableau access token expiration in seconds * Treat all timestamps in seconds * Add getTableauAuthInfo * Update tools to use OAuth info (#148) * Log username * Update tools * Add prompt when disabling OAuth * Rename to DANGEROUSLY_DISABLE_OAUTH * Add OAuth tests (#149) * Add supertest and OAuth tests * Run OAuth tests during CI * Remove OAUTH_JWE_PRIVATE_KEY_PASSPHRASE * Remove more unneeded env vars * Remove unneeded TRANSPORT * Address Copilot suggestions * s/return/await * Add additional refresh_token coverage * Update should redirect to Tableau OAuth * Improve afterEach * Add invalid token request test * Add OAuth docs (#150) * Add mermaid theme * Fix mermaid theme version * Add OAuth docs * Rename optional.md to env-vars.md * Merge env var files * Update warnings * Add warning to http-server * Update docs --------- Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]> * Bump version --------- Co-authored-by: Copilot <[email protected]>
1 parent 09e27d2 commit 3cc5eb0

File tree

105 files changed

+5938
-194
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

105 files changed

+5938
-194
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@ jobs:
5656
CONNECTED_APP_SECRET_ID: ${{ secrets.E2E_TEST_CONNECTED_APP_SECRET_ID }}
5757
CONNECTED_APP_SECRET_VALUE: ${{ secrets.E2E_TEST_CONNECTED_APP_SECRET_VALUE }}
5858

59+
- name: OAuth Tests
60+
run: npm run test:oauth
61+
env:
62+
SERVER: ${{ secrets.E2E_TEST_SERVER }}
63+
SITE_NAME: ${{ secrets.E2E_TEST_SITE_NAME }}
64+
OAUTH_ISSUER: http://127.0.0.1:3927
65+
OAUTH_JWE_PRIVATE_KEY: ${{ secrets.OAUTH_TEST_OAUTH_JWE_PRIVATE_KEY }}
66+
OAUTH_JWE_PRIVATE_KEY_PASSPHRASE: ${{ secrets.OAUTH_TEST_OAUTH_JWE_PRIVATE_KEY_PASSPHRASE }}
67+
5968
- name: Build Claude MCP Bundle
6069
run: |
6170
npm run build:manifest:script

‎.github/workflows/test-deploy.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,10 @@ jobs:
2929
run: npm ci
3030
- name: Test build website
3131
run: npm run build
32+
- name: Upload artifacts
33+
uses: actions/upload-artifact@v4
34+
with:
35+
name: artifacts
36+
if-no-files-found: error
37+
path: |
38+
docs/build/

‎config.http.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"mcpServers": {
33
"tableau": {
44
"type": "streamable-http",
5-
"url": "http://localhost:3927/tableau-mcp"
5+
"url": "http://127.0.0.1:3927/tableau-mcp"
66
}
77
}
88
}

‎docs/docs/configuration/mcp-config/authentication/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,4 @@ There are a couple different ways to authenticate to Tableau.
99

1010
1. Provide your Tableau [Personal Access Token](pat.md) (PAT).
1111
2. Use Tableau [Connected Apps](direct-trust.md).
12+
3. Use Tableau [OAuth](oauth.md).

‎docs/docs/configuration/mcp-config/authentication/_category_.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
22
"label": "Authentication",
3-
"position": 4
3+
"position": 2
44
}

‎docs/docs/configuration/mcp-config/authentication/direct-trust.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
---
2-
sidebar_position: 3
3-
title: Direct Trust
2+
sidebar_position: 2
43
---
54

65
# Direct Trust
@@ -22,6 +21,8 @@ it internally calls into VizQL Data Service, the JWT will only have the
2221

2322
The username for the `sub` claim of the JWT.
2423

24+
- Can either be a hard-coded username, or the OAuth username by setting it to `{OAUTH_USERNAME}`.
25+
2526
<hr />
2627

2728
### `CONNECTED_APP_CLIENT_ID`
@@ -53,12 +54,13 @@ code where it could accidentally be revealed.
5354

5455
### `JWT_ADDITIONAL_PAYLOAD`
5556

56-
A JSON string that includes any additional user attributes to include on the JWT.
57+
A JSON string that includes any additional user attributes to include on the JWT. It also supports
58+
dynamically including the OAuth username.
5759

5860
Example:
5961

6062
```json
61-
{ "region": "West" }
63+
{ "username": "{OAUTH_USERNAME}", "region": "West" }
6264
```
6365

6466
[direct-trust]: https://help.tableau.com/current/online/en-us/connected_apps.htm#direct-trust

‎docs/docs/configuration/mcp-config/authentication/oauth.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
sidebar_position: 3
3+
---
4+
5+
# OAuth
6+
7+
:::warning
8+
9+
Tableau Server 2025.3+ only. Full Tableau Cloud is not supported yet but is coming soon ETA Q2 2026.
10+
Until then, enabling OAuth support against a Tableau Cloud site will only work when the MCP server
11+
is accessed using a local development URL e.g. `http://127.0.0.1:3927/tableau-mcp`.
12+
13+
:::
14+
15+
When `AUTH` is `oauth`, the MCP server will use a Tableau session initiated by the Tableau OAuth
16+
flow to authenticate to the Tableau REST APIs.
17+
18+
:::info
19+
20+
See [Enabling OAuth](../oauth.md) for details on how to configure the MCP server to use OAuth.
21+
22+
:::

‎docs/docs/configuration/mcp-config/authentication/pat.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
sidebar_position: 2
2+
sidebar_position: 1
33
title: PAT
44
---
55

‎docs/docs/configuration/mcp-config/optional.md‎ renamed to ‎docs/docs/configuration/mcp-config/env-vars.md‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,30 @@
11
---
2-
sidebar_position: 2
2+
sidebar_position: 1
33
---
44

5-
# Optional Environment Variables
5+
# Environment Variables
66

7-
Values for the following environment variables are optional.
7+
Values for the following environment variables can be provided to configure the Tableau MCP server.
8+
9+
## `SERVER`
10+
11+
The URL of the Tableau server.
12+
13+
- For Tableau Cloud, specify your site's specific pod e.g.
14+
`https://prod-useast-c.online.tableau.com`
15+
- Required unless [`AUTH`](#auth) is `oauth`.
16+
17+
<hr />
18+
19+
## `SITE_NAME`
20+
21+
The name of the Tableau site to use.
22+
23+
- For Tableau Cloud, specify your site name.
24+
- For Tableau Server, you may leave this value blank to use the default site.
25+
- Required unless [`AUTH`](#auth) is `oauth`.
26+
27+
<hr />
828

929
## `TRANSPORT`
1030

@@ -19,10 +39,10 @@ The MCP transport type to use for the server.
1939

2040
## `AUTH`
2141

22-
The Tableau authentication method to use by the server.
42+
The method the MCP server uses to authenticate to the Tableau REST APIs.
2343

2444
- Default: `pat`
25-
- Possible values: `pat` or `direct-trust`
45+
- Possible values: `pat`, `direct-trust`, or `oauth`
2646
- See [Authentication](authentication) for additional required variables depending on the desired
2747
method.
2848

@@ -43,6 +63,8 @@ APIs.
4363
- Each line in the log file is a JSON object with the following properties:
4464

4565
- `timestamp`: The timestamp of the log message in UTC time.
66+
- `username`: For tool calls, the username of the user who made the call. This is only present
67+
when OAuth is enabled and has the user context.
4668
- `level`: The logging level of the log message.
4769
- `logger`: The logger of the log message. This is typically `rest-api` for HTTP traces or
4870
`tableau-mcp` for tool calls.

‎docs/docs/configuration/mcp-config/http-server.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,16 @@ sidebar_position: 5
77
The Tableau MCP server can be configured to run as an HTTP server, leveraging the Streaming HTTP MCP
88
transport. This is useful for deploying the server remotely and exposing it to multiple clients.
99

10+
:::warning
11+
12+
When `TRANSPORT` is `http`, the default behavior changes to require protecting your MCP server with
13+
OAuth as a security best practice.
14+
15+
To opt out of this behavior at your own risk, please see the entry on
16+
[`DANGEROUSLY_DISABLE_OAUTH`](oauth.md#dangerously_disable_oauth).
17+
18+
:::
19+
1020
When `TRANSPORT` is `http`, the following environment variables can be used to configure the HTTP
1121
server. They are all optional.
1222

0 commit comments

Comments
 (0)