Troubleshooting Tableau Server Data Ingestion Error: 403 Forbidden

ingestion
1

Original Slack Thread

hello guys,
i am trying to ingest data from Tableau Server,

  1. Doing the ingestion using Datahub CLI
  2. Datahub version: v0.13.3rc1
  3. Tableau Server
    This is my YAML File:
    type: tableau
    config:
        connect_uri: '<https://data.mycompany.com>'
        stateful_ingestion:
            enabled: false
        username: my_username
        password: my_password
        ingest_owner: true
        extract_lineage_from_unsupported_custom_sql_queries: true
        ingest_tags: true
        extract_usage_stats: true
        ingest_tables_external: true
        site: ""
        projects:
            - project1
            - project2 ```
i'm running in the CLI:
```pip install 'acryl-datahub[tableau]'```
and then:
```datahub ingest run -c tableau_ingestion.yaml```
i get the error below :
```tableauserverclient.server.endpoint.exceptions.NonXMLResponseError: b'{"timestamp":"2024-06-13T13:26:48.519+00:00","status":403,"error":"Forbidden","path":"/relationship-service-war/graphql"}'```
any suggestions what it can be?
Thanks
2

Hey there! :wave: Make sure your message includes the following information if relevant, so we can help more effectively!

  1. Are you using UI or CLI for ingestion?
  2. Which DataHub version are you using? (e.g. 0.12.0)
  3. What data source(s) are you integrating with DataHub? (e.g. BigQuery)

<@U06TM7M40RK> Can you help with the questions in this thread?

:information_source: We’re experimenting with a new AI assistant for questions in the <#CUMUWQU66> channel to help you track down helpful resources more quickly. Keep in mind that responses may not always be spot-on; feel free to ask it follow-up questions and don’t forget to provide its responses a :thumbsup: or :thumbsdown: so other folks in the Community know if you’re still looking for help on the topic!

3

To help you troubleshoot the issue with ingesting data from Tableau Server into DataHub, let’s break down the problem and potential solutions:

Error Analysis

  1. 403 Forbidden Error:
    • This error typically indicates that the server understood the request but refuses to authorize it. This could be due to insufficient permissions or incorrect credentials.

Potential Solutions

  1. Check Permissions:

    • Ensure that the user account you are using has the necessary permissions to access the Tableau Server and perform the required operations. According to <Slack Slack thread>, insufficient permissions can cause similar issues.

  2. Correct Endpoint and Authentication:

    • Verify that you are using the correct endpoint and authentication method. As per <Slack Slack thread>, using the correct endpoint (/api/graphql instead of /api/graphIql) and ensuring proper authentication (e.g., using cookies or tokens) is crucial.

  3. Debug Mode:

    • Enable debug mode to get more detailed logs, which can help identify the root cause of the issue. You can do this by running the ingestion command with the --debug flag, as suggested in <Slack Slack thread>.

  4. Check XML Response:

    • Inspect the XML response being received to ensure it is well-formed. This might involve checking the Tableau Server’s response format or any intermediary systems that might be altering the response.

Example Configuration
Here is an example of a YAML configuration for Tableau ingestion:

source:
  type: tableau
  config:
    connect_uri: '${TABLEAU_ADDRESS}'
    platform_instance: acryl_instance
    project_pattern: ["^default$", "^Project 2$", "^/Project A/Nested Project B$"]
    username: '${TABLEAU_USER}'
    password: '${TABLEAU_PASSWD}'
    page_size: 10
    ingest_tags: True
    ingest_owner: True
    stateful_ingestion:
      enabled: True
      remove_stale_metadata: true

Next Steps

  1. Verify Permissions: Ensure the user has the necessary permissions on Tableau Server.
  2. Check Endpoint and Authentication: Confirm you are using the correct endpoint and authentication method.
  3. Enable Debug Mode: Run the ingestion in debug mode to get more detailed logs.
  4. Inspect XML Response: Check the XML response for any malformations.

Would you like more detailed steps on any of these points?

Sources:

  • <Slack Thread on Permissions>
  • <Slack Thread on Endpoint and Authentication>
  • <Slack Thread on Debug Mode> :+1: 0 button :-1: 0 button :bulb: Hint: Mention @runllm in the thread for followups.
4

<@U02AF5P6QDS> can you please have a look?
the RunLLM replay doesn’t address my question,
thanks!

5

/relationship-service-war/graphql seems to be an endpoint at tableau you are not allowed to access. Have you checked permission of the user you are using?

6

Hi <@U02AF5P6QDS>
yes, this user has admin permissions at tableau server

7

<@U02AF5P6QDS>
We can try with a different user that is not the Sever Administrator like a “Site Administrator Explorer”, would that be good?

8

I do not know Tableau good enough to suggest something with roles and permissions here. Sorry

9

This (together with another fix) worked, thanks for your help!