From 29c468bb7dd049202d925c15204e67594b6974b6 Mon Sep 17 00:00:00 2001 From: Carolina Roncaglia Date: Tue, 3 Nov 2026 10:46:46 -0300 Subject: [PATCH 1/2] docs: correct the locked-project restriction and document the undocumented sync limits Restate the comma and ampersand restriction as one on filter values rather than on project names, and retype it as a note: Tableau accepts both characters in a project name and rejects them inside a filter expression. Document, on the customer-facing page, the limitations the README and docs-info.md already recorded: Personal Space workbooks are not synced, the All Users group cannot be changed through the API, Server Administrator users are skipped during group membership sync, and a license revoke fails against a group's minimum site role. Document that revoking a permission a user holds only through a group leaves the access in place. Correct the frontmatter description to the provisioning variant and match og:description to it, and correct the README's permission counts and project entitlement names to the slugs the connector emits. Co-Authored-By: Claude Opus 5 --- README.md | 10 +++++----- docs/connector.mdx | 26 +++++++++++++++++++++----- 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index c7c629cb..45c3cf42 100644 --- a/README.md +++ b/README.md @@ -46,8 +46,8 @@ baton resources - **Users** — All users on the site with email, site role, auth setting, and last login - **Groups** — Tableau groups with membership information - **Licenses** — License tiers (Creator, Explorer, Viewer, Unlicensed) with role-based assignment and purchased/consumed seat counts -- **Projects** — Tableau projects with Read/Write permission assignments for users and groups -- **Workbooks** — Tableau workbooks with 15 granular permission assignments for users and groups +- **Projects** — Tableau projects with `View` and `Publish` permission assignments, plus the 16 `Workbook / ...` permissions that apply to the workbooks inside the project, for users and groups +- **Workbooks** — Tableau workbooks with 16 granular permission assignments for users and groups - **Views** — Individual dashboards/views with granular permissions (inherited from workbook when `showTabs=true`) `baton-tableau` supports the following provisioning operations: @@ -59,8 +59,8 @@ baton resources | Site Roles | Grant/Revoke | Assign/remove site-wide roles (Creator, Explorer, SiteAdministratorCreator, etc.) | | Licenses | Grant/Revoke | Assign/remove license tiers by updating site role | | Groups | Grant/Revoke | Add/remove users from groups | -| Projects | Grant/Revoke | Assign/remove Read, Write permissions for users and groups | -| Workbooks | Grant/Revoke | Assign/remove 15 granular permissions for users and groups | +| Projects | Grant/Revoke | Assign/remove the `View` and `Publish` project permissions, plus the 16 `Workbook / ...` default workbook permissions, for users and groups | +| Workbooks | Grant/Revoke | Assign/remove 16 granular permissions for users and groups | | Views | Grant/Revoke | Assign/remove view permissions for users and groups (when `showTabs=false`) | ## Important Notes @@ -69,7 +69,7 @@ baton resources - **showTabs**: When a workbook has `showTabs=true`, view-level permissions are inherited from the workbook and cannot be modified independently. Grant/Revoke on those views are blocked with a descriptive error. - **Views in Personal Space**: Workbooks in a user's Personal Space (not under any project) are not synced, and therefore their views are not synced either. - **Server Administrators**: Users with `ServerAdministrator` site role are skipped during group membership sync (server-level admins are not site-scoped). -- **Grant expansion**: Group-based permissions on projects, workbooks, and views are supported. When a group has a permission, all members inherit it. +- **Grant expansion**: Group-based permissions on projects, workbooks, and views are supported. When a group has a permission, all members inherit it. Revoking such a permission from a single member does not remove their access: Tableau has no user-level assignment to remove, so the revoke returns `GrantAlreadyRevoked` and the next sync derives the permission from the group again. Revoke from the group, or remove the user from the group. - **"All Users" group**: Tableau automatically adds every user to the built-in "All Users" group. This group cannot be modified via the API — Grant and Revoke operations on it are not supported. The connector syncs its membership to show each user's base site role. - **License revoke constraints**: Revoking a license (setting a user to "Unlicensed") will fail if the user belongs to a group with a "Grant role on sign in" minimum site role. Remove the user from the constraining group first, then revoke the license. - **Locked project names**: Inherited workbook grants for locked projects are found by filtering workbooks on the project name, and Tableau rejects filters containing commas (`,`) or ampersands (`&`). Locked projects whose names contain these characters are skipped for inherited workbook grants and a warning is logged. Rename those projects to sync their inherited access. diff --git a/docs/connector.mdx b/docs/connector.mdx index 7a23653e..d6cddab3 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -1,8 +1,8 @@ --- title: Set up a Salesforce Tableau connector og:title: Set up a Salesforce Tableau connector - C1 docs -og:description: Integrate your Salesforce Tableau instance with C1 to run user access reviews, enable just-in-time access requests, and easily provision and deprovision access. -description: C1 provides identity governance for Salesforce Tableau. Integrate your Salesforce Tableau instance with C1 to run user access reviews (UARs) and enable just-in-time access requests. +og:description: C1 provides identity governance and just-in-time provisioning for Tableau. Integrate your Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access. +description: C1 provides identity governance and just-in-time provisioning for Tableau. Integrate your Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access. sidebarTitle: Salesforce Tableau --- @@ -20,6 +20,12 @@ sidebarTitle: Salesforce Tableau The Tableau connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning). +**Notes:** + +- Workbooks in a user's Personal Space do not belong to a project, and the connector does not sync them. Their views are not synced either, so the workbook and view counts in C1 are lower than the totals Tableau reports for the site. +- Tableau adds every user to the built-in **All Users** group and does not allow that group to be changed through the API. C1 treats a request to add a member as already satisfied, and a revoke returns an error. +- Users with the **Server Administrator** site role are server-level rather than site-scoped, so the connector skips them when it syncs group membership. + ## Licenses and seats In Tableau, licensing is role-based: each user's **site role** determines their license tier. There is no separate license object to assign — granting a license means setting the user's site role. The connector surfaces four tiers: @@ -33,20 +39,30 @@ In Tableau, licensing is role-based: each user's **site role** determines their When your Tableau site has per-tier seat capacities configured, C1 tracks the purchased and consumed seat counts for each license tier, so you can review license utilization alongside who holds each tier. + +Tableau does not allow a site role lower than the minimum site role of any group the user belongs to. Revoking a license from a user who belongs to a group configured with **Grant role on sign in** fails with the error `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license. + + ## Permission inheritance Tableau uses a permission inheritance model that affects how access is synced and provisioned: - **Projects with `LockedToProject`**: When a project's content permissions are set to `LockedToProject`, workbooks inside that project inherit the project's permissions and cannot be granted or revoked independently — permissions must be changed at the project level instead. - -Tableau does not allow commas (`,`) or ampersands (`&`) in the project names the connector uses to find a project's workbooks. If a project with locked permissions has one of these characters in its name, C1 can't sync the access its workbooks inherit from that project. We recommend renaming these projects without commas or ampersands. - + +Tableau rejects commas (`,`) and ampersands (`&`) inside a filter value, even when they are encoded. The connector finds a locked project's workbooks by filtering on the project name, so when a locked project's name contains one of these characters, C1 does not sync the access its workbooks inherit from that project. The rest of the sync completes. Rename those projects without commas or ampersands to sync their inherited access. + - **Workbooks with `showTabs=true`**: Views (dashboards) inside these workbooks inherit their permissions from the workbook. View-level permissions cannot be granted or revoked independently — attempting to do so returns a clear error. Use the workbook entitlement instead. - **Workbooks with `showTabs=false`**: Views have their own independent permission assignments, which can be granted and revoked directly. +- **Permissions granted to a group**: Every member of the group holds the permission, and C1 shows the group as the source of each member's grant. + + +Revoking a permission from a user who holds it only through a group does not remove the user's access. The revoke succeeds, because Tableau has no user-level assignment to remove, and the next sync derives the permission from the group again. To remove the access, revoke the permission from the group or remove the user from the group. + + ## Gather Tableau credentials Configuring the connector requires you to pass in credentials generated in Tableau. Gather these credentials before you move on. From eaa552cccdba310397e0baf3ddf695fca2b1f056 Mon Sep 17 00:00:00 2001 From: Carolina Roncaglia Date: Thu, 5 Nov 2026 14:33:32 -0300 Subject: [PATCH 2/2] docs: apply review wording, keep the Salesforce Tableau name, fix the All Users claim README said Grant and Revoke are unsupported on the All Users group. Grant returns GrantAlreadyExists (pkg/connector/group.go:141-145), so it succeeds as a no-op and only Revoke errors. Frontmatter keeps "Salesforce Tableau" in og:description and description, so all five fields match the name #47 aligned with the docs site. The locked-project and group-revoke Notes move below the "Permission inheritance" list: a Note between bullets splits the list when rendered. Remaining edits shorten the Notes bullets and state the effect instead of the mechanism. Co-Authored-By: Claude Opus 5 --- README.md | 2 +- docs/connector.mdx | 22 +++++++++++----------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 45c3cf42..507785be 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ baton resources - **Views in Personal Space**: Workbooks in a user's Personal Space (not under any project) are not synced, and therefore their views are not synced either. - **Server Administrators**: Users with `ServerAdministrator` site role are skipped during group membership sync (server-level admins are not site-scoped). - **Grant expansion**: Group-based permissions on projects, workbooks, and views are supported. When a group has a permission, all members inherit it. Revoking such a permission from a single member does not remove their access: Tableau has no user-level assignment to remove, so the revoke returns `GrantAlreadyRevoked` and the next sync derives the permission from the group again. Revoke from the group, or remove the user from the group. -- **"All Users" group**: Tableau automatically adds every user to the built-in "All Users" group. This group cannot be modified via the API — Grant and Revoke operations on it are not supported. The connector syncs its membership to show each user's base site role. +- **"All Users" group**: Tableau automatically adds every user to the built-in "All Users" group. This group cannot be modified via the API: Grant is a no-op because the user is already a member, and Revoke returns an error. The connector syncs its membership to show each user's base site role. - **License revoke constraints**: Revoking a license (setting a user to "Unlicensed") will fail if the user belongs to a group with a "Grant role on sign in" minimum site role. Remove the user from the constraining group first, then revoke the license. - **Locked project names**: Inherited workbook grants for locked projects are found by filtering workbooks on the project name, and Tableau rejects filters containing commas (`,`) or ampersands (`&`). Locked projects whose names contain these characters are skipped for inherited workbook grants and a warning is logged. Rename those projects to sync their inherited access. - **Idempotency**: Granting a permission that already exists returns success (not an error). Revoking a permission that is already removed also returns success. diff --git a/docs/connector.mdx b/docs/connector.mdx index d6cddab3..e7f12d5e 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -1,8 +1,8 @@ --- title: Set up a Salesforce Tableau connector og:title: Set up a Salesforce Tableau connector - C1 docs -og:description: C1 provides identity governance and just-in-time provisioning for Tableau. Integrate your Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access. -description: C1 provides identity governance and just-in-time provisioning for Tableau. Integrate your Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access. +og:description: C1 provides identity governance and just-in-time provisioning for Salesforce Tableau. Integrate your Salesforce Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access. +description: C1 provides identity governance and just-in-time provisioning for Salesforce Tableau. Integrate your Salesforce Tableau instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access. sidebarTitle: Salesforce Tableau --- @@ -22,9 +22,9 @@ The Tableau connector supports [automatic account provisioning and deprovisionin **Notes:** -- Workbooks in a user's Personal Space do not belong to a project, and the connector does not sync them. Their views are not synced either, so the workbook and view counts in C1 are lower than the totals Tableau reports for the site. -- Tableau adds every user to the built-in **All Users** group and does not allow that group to be changed through the API. C1 treats a request to add a member as already satisfied, and a revoke returns an error. -- Users with the **Server Administrator** site role are server-level rather than site-scoped, so the connector skips them when it syncs group membership. +- Workbooks in a user's Personal Space don't belong to a project, so C1 doesn't sync them or their views. +- C1 syncs membership of the built-in **All Users** group but can't change it, because Tableau doesn't allow that group to be modified through the API. +- C1 doesn't show users with the **Server Administrator** site role as group members. ## Licenses and seats @@ -40,7 +40,7 @@ When your Tableau site has per-tier seat capacities configured, C1 tracks the pu -Tableau does not allow a site role lower than the minimum site role of any group the user belongs to. Revoking a license from a user who belongs to a group configured with **Grant role on sign in** fails with the error `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license. +Revoking a license fails if the user belongs to a group with a **Grant role on sign in** minimum site role. Tableau returns `Site role of link user that belongs to license upon login cannot be lower than minimum site role of group`. Remove the user from that group first, then revoke the license. ## Permission inheritance @@ -49,10 +49,6 @@ Tableau uses a permission inheritance model that affects how access is synced an - **Projects with `LockedToProject`**: When a project's content permissions are set to `LockedToProject`, workbooks inside that project inherit the project's permissions and cannot be granted or revoked independently — permissions must be changed at the project level instead. - -Tableau rejects commas (`,`) and ampersands (`&`) inside a filter value, even when they are encoded. The connector finds a locked project's workbooks by filtering on the project name, so when a locked project's name contains one of these characters, C1 does not sync the access its workbooks inherit from that project. The rest of the sync completes. Rename those projects without commas or ampersands to sync their inherited access. - - - **Workbooks with `showTabs=true`**: Views (dashboards) inside these workbooks inherit their permissions from the workbook. View-level permissions cannot be granted or revoked independently — attempting to do so returns a clear error. Use the workbook entitlement instead. - **Workbooks with `showTabs=false`**: Views have their own independent permission assignments, which can be granted and revoked directly. @@ -60,7 +56,11 @@ Tableau rejects commas (`,`) and ampersands (`&`) inside a filter value, even wh - **Permissions granted to a group**: Every member of the group holds the permission, and C1 shows the group as the source of each member's grant. -Revoking a permission from a user who holds it only through a group does not remove the user's access. The revoke succeeds, because Tableau has no user-level assignment to remove, and the next sync derives the permission from the group again. To remove the access, revoke the permission from the group or remove the user from the group. +If a locked project's name contains a comma (`,`) or an ampersand (`&`), C1 doesn't sync the access its workbooks inherit from that project, because Tableau rejects these characters in the filter the connector uses to find them. Rename those projects without commas or ampersands to sync their inherited access. + + + +Revoking a permission from a user who holds it only through a group doesn't remove their access: the next sync shows it again, granted through the group. Revoke the permission from the group, or remove the user from the group. ## Gather Tableau credentials