Repository navigation
@W-24145098 - docs: document WIF admin REST API endpoints - #1895
Open
sushmasreedharan-tableau wants to merge 3 commits into
Open
sushmasreedharan-tableau wants to merge 3 commits into
sushmasreedharan-tableau wants to merge 3 commits into
Conversation
Documents the new server.auth_federation endpoint added in PR tableau#1894 on the tableau/server-client-python main branch. - New top-level section 'Auth Federation' in docs/api-ref.md, between 'Authentication' and 'Connections'. Documents: - AuthFederationItem, AuthFederationConnectorItem, AuthFederationKeyItem class attribute tables. - 12 endpoint methods: get, enable, update, delete; create_connector, list_connectors, get_connector, delete_connector; create_key, activate_key, deactivate_key, delete_key. - Signature, parameters, return type, and example per method. - Server behavior notes callers can't derive from the signature: per-method 403/404 semantics, PAT/scope acceptance, orphan-key risk when create_key runs before enable, safe-rotation order for keys, and client-side UUID validation that raises ValueError on malformed ids before any HTTP call. - _includes/docs_menu.html: adds an 'Auth Federation' entry in the API Reference sidebar between 'Authentication' and 'Connections'. Requires REST API 3.30+ (Tableau Server release 26.3) and the WIF feature enabled on the site; the server returns 403 otherwise, including on get(). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The code PR's docstring + CHANGELOG now clarify that the old key must be retained in the site's JWKS until every JWT it signed has expired, and only then deleted. The previous `create_key() -> activate_key(new) -> delete_key(old)` sequence skipped that retain step; deleting the old key immediately removes it from the JWKS and verifiers that fetch the key set afterwards reject the still-valid tokens signed with it. Updated the `auth_federation.delete_key` section here to match. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Code PR dropped the activate_key chain from `delete_key` and refocused the docstring on the delete-vs-deactivate distinction (both stop new signing with the key, but delete also pulls it from the JWKS, breaking verification for still-unexpired tokens). Mirror that framing here. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the new
server.auth_federationendpoint added totableauserverclientin PR #1894 (onmain). Companion to the already-merged connection-field docs in PR #1892 (W-24145082).docs/api-ref.md, placed between Authentication and Connections (alphabetical with the existing sidebar).AuthFederationItem,AuthFederationConnectorItem, andAuthFederationKeyItemclass attributes.get,enable,update,delete; connectors:create_connector,list_connectors,get_connector,delete_connector; keys:create_key,activate_key,deactivate_key,delete_key. Each method has signature, version note, parameter table, return type, exceptions where relevant, and example.NO_ACCESSwhile scoped sessions see 401, orphan-key risk whencreate_keyis called beforeenable, safe-rotation order (create_key->activate_key(new)->delete_key(old)), and client-side UUID validation that raisesValueErroron malformed ids before any HTTP call._includes/docs_menu.html: adds an Auth Federation entry to the API Reference sidebar between Authentication and Connections.Requires REST API 3.30+ (Tableau Server release 26.3) and the WIF feature enabled on the site; the server returns 403 otherwise, including on
get().Pair PR: #1894 - @W-24145098 - Add Workload Identity Federation (WIF) admin REST API
GUS: W-24145098
🤖 Generated with Claude Code