We have an on-prem server with a single site and set of users. We have GCP users that are part of two separate GCP environments that would both like to connect to their Google Drive data. In Tableau Server it seems I can only set up the client ID and secrets in the OAuth Clients Registry for one, trying to add a second only replaces the existing. This causes whichever user whose token is not currently in the tableau settings to run into a 403 forbidden error. Is there a way to accommodate both in Tableau? Could it be done with custom oauth? Is there a setting in google that would allow one GCP to use the oauth settings from the other?
#Tableau Desktop & Web Authoring
Hey Gordon, yeah this is a known pain point, Tableau Server's OAuth Client Registry only allows one client config per connection type (like Google Drive) at a time, so adding a second GCP project's client ID just overwrites the first one instead of coexisting.
A few things to consider:
Custom OAuth config (the XML-based one, not the built-in registry) is actually your best bet here. Instead of using the default Google Drive OAuth setup, you can create a custom OAuth connector config per GCP project and register both as separate "custom" connections. Users would then pick the right one when connecting, kind of like having two different named connectors. It's a bit of manual setup but it does work.
On the Google side, there isn't really a clean way to make one GCP project inherit or share OAuth credentials with another, they're treated as fully separate apps by Google's OAuth consent screen, so that route's a dead end.
Realistically, most people in this situation end up doing the custom OAuth XML approach with two distinct client IDs/secrets, or they consolidate to a single GCP project for Drive access if that's politically possible on your end. It's not elegant, but it avoids the 403 issue since each user hits the right client config.
