Tableau Integration
Usage information
The Stemma Tableau integration will sum view counts for all workbooks in a particular dashboard over all time.
Installation Instructions
This document walks through the steps required to create a service account in your Tableau, which will be connected to your Stemma Instance for metadata extraction.
Stemma uses the Tableau Metadata API (GraphQL) to extract the metadata of projects, workbooks, dashboards, and data sources associated with them. The Stemma integration is purely read-only and doesn’t modify any assets in Tableau.
Read Tableau’s docs: https://help.tableau.com/current/api/metadata_api/en-us/index.html
Connection Type:
We support both Online and Extract Connections with no differences.
Steps
Step 1: Decide your authentication strategy
The Tableau Metadata API is authenticated using a Personal Access Token (PAT) attached to a specific user within your organization. You will always share with us the PAT, not the username/password of the user itself. The PAT has the same permissions as the user to which it is attached.
Most users simply will simply create a PAT attached to their admin account. This is the easiest to set up and simplest to manage longer term, and we recommend it. For this option, skip to Step 4.
However, because this means the PAT has write access to the instance and Stemma doesn’t use write access at all, this doesn’t strictly follow principle of least privilege. In cases where restricting such access is critical, we recommend creating a read-only service account, and then you’ll generate a PAT for that limited account. Continue to Step 2 for this option.
Step 2: Create a new Viewer user
If you decide to create a new user for this integration (otherwise skip to Step 4 to use your current user to generate the Personal Access Token), navigate to the Users menu from the side navigation.
Click on “Add Users” and select “Add Users by Email“. A popup will appear with a Form to create new Users.
Select the “Tableau” radio button, and write down the email address you want. You will not share this email address with Stemma, and use this to sign in to the Tableau instance in order to create a PAT.
Email Tip: If you use Google email, [your_current_user][email protected][your-domain] will allow you to receive emails on your current email address and satisfy the uniqueness requirement.
Select “Viewer” as the Site role, which will give this user minimum access to the Tableau, and click “Add Users” to finalize the user creation.
Step 3: Set up permissions for the user
The next step is to make sure the user has permission to read your externally connected data sources. This will be used to link the workbooks with the tables in Stemma. By default, a “Viewer” user will not have access to any data source.
Click on the “External Assets” from the side navigation, click on “Select All“. A new dropdown will appear. Click on the “Actions” dropdown and select “Permissions“.
A Permissions dialog will appear under the “Permission Rules” section. By default, you will be on the “Database” tab.
Click “+ Add Group/User Rule” and select the user you created in Step 2 of this document, set the Template “View” and Save the rule.
Click on the “Tables” tab, and repeat the steps to add the rule for the user with the “View” template.
Stemma uses information about the upstream data sources in order to automatically create data lineage from your dashboard to your upstream table. In order to enable this, Stemma needs access to read the data source metadata. To enable the Stemma user permissions required by the Tableau Metadata API, you will need to provide “View” and “Connect“” access to each data source and workbook that Stemma will read from.
Step 4: Create a Personal Access Token
Log in to your Tableau instance with the user you want to use for Stemma integration. If you created a new user for this integration, make sure you log in as that user.
Select My Account Settings from the dropdown of your profile.
Scroll down to the “Personal Access Tokens” section, enter the token name “stemmaViewer” and click “Create new token”.
A new pop-up will appear with the personal access token and secret. Make sure you copy these somewhere safe as they will not be displayed again.
Step 5: Provide the details to Stemma
- Navigate to the Admin tab of the Stemma UI and choose Connections and Add New Connection
- In the pop-up window, choose Tableau as the Connection type, provide a Connection Name, and then in the dialog box fill out the fields as follows:
- When you are finished, click Save Connection.
Optional: You can opt to exclude or include some items by providing the following to Stemma by email or Slack:
- Name of Projects to Exclude: If you want to exclude any sample projects or test projects from Stemma, provide the names of those projects.
- External Assets Types to Include (Connection type):This is uncommon, but if you want to include and link only certain types of external assets with your Tableau workbooks in Stemma, provide the names of those assets you want to include and link. Note that this may limit the user experience of Stemma, and is not recommended.