Skip to main content
Topics#Tableau APIs & EmbeddingRaghul Kumar's Question
Raghul Kumar asked in #Tableau APIs & Embedding
Mar 24, 10:32 AM

Dynamic Oauth support for Custom TACO Connector

We're building a TACO 3.0 EPS connector for a multi-region SaaS platform, Endpoint central Cloud, where both the OAuth authorization server, and the  API server,  varies by region (e.g. accounts.zoho.com, accounts.zoho.in, accounts.zoho.eu). We need the OAuth URLs to be dynamic — exactly like the built-in OneDrive connector's "OAuth Instance URL" prompt.    {instanceUrl} in oauth-config.xml only resolves via TCD's <show-instance-url-prompt>. EPS connectors can't use TCD because the manifest schema enforces xs:choice between connection-fields and connection-dialog, and EPS requires connection-fields.    We tried multiple workaround — setting instanceUrl as a connection field (passed in attrs but ignored by OAuth service), defaultInstanceUrl (not used as fallback), requiredAuthAttrs, server-oauth field — none resolve the {instanceUrl} placeholder.    Due to this, we are unable to build a multi region connector, and are forced to build per region connector.    Environment: Tableau 2026.1, TACO Toolkit 2.2.0   

1 answer
  1. Matthias Giger (T.B.A.)
    Mar 26, 7:33 PM

    Hi @Raghul Kumar

     

     

    I asked Claude and asked it again to verify the answer. So, please, review it with caution as AI answers might sound confident but can be wrong.   

     

    This is what

    Claude.ai

    came up with:  

     

    Title:

    TACO 3.0 EPS Connector: Dynamic OAuth Instance URLs per Region – Known Limitation 

    Body:

     

    I’ve researched this thoroughly and want to share findings that may help others facing the same constraint. 

    The Problem (Confirmed)

     

    You’ve correctly identified a hard architectural limitation in TACO 3.0 EPS connectors: EPS-based OAuth connectors have a dependency on Tableau OAuth support and cannot run with the EPS standalone server

    Tableau. More critically, EPS connectors cannot prompt for region-specific OAuth endpoints dynamically

    , unlike built-in connectors like OneDrive. 

    Why Your Workarounds Failed

     

    The root cause is the schema constraint between TCD (Tableau Connector Dialog) and EPS:

    • TCD-based plugins can use <show-instance-url-prompt> to collect dynamic OAuth endpoints from users at connection time. This is how OneDrive and SharePoint Online connectors prompt users with an “OAuth Instance URL” dialog to enter tenant-specific or custom connection endpoints Tableau.
    • EPS connectors (TACO 3.0) use connector.json without dialog support—only stateless field submission. The EPS server only tests EPS connector logic and doesn’t consume TACO infrastructure files like manifest.xml Tableau.

    Setting {instanceUrl} or {region} in oauth-config.xml doesn’t work because those placeholders are resolved only within TCD’s connection-dialog context, which EPS cannot access. 

    Known Community Request

     

    This exact scenario was raised as a feature request: Databricks requested SDK support for multiple OAuth endpoints per connector, proposing dynamic loading of oauth-config.xml based on detected cloud provider

    GitHub. See: https://github.com/tableau/connector-plugin-sdk/issues/705

     

    Status:

    Still open as of 2025

    with no EPS-specific solution. 

    Practical Workarounds

     

    1.

    Multi-Config Approach (EPS-viable but not elegant):

     

    Create separate oauth-config.xml files per region (e.g., oauth-config-us.xml, oauth-config-eu.xml, oauth-config-in.xml) in your connector. Add logic in your app UI to present a region dropdown, then conditionally load the matching config. This requires connector regeneration per region but keeps EPS architecture intact. 

    2.

    Switch to TCD (Plugin SDK):

     

    If your use case allows, migrate to the standard Tableau Connector Plugin SDK (ODBC/JDBC-based) instead of TACO/EPS. This gives you full connection-dialog support and the ability to prompt for dynamic OAuth endpoints. See:

    https://tableau.github.io/connector-plugin-sdk/docs/oauth-dev

     

    3.

    Escalate with Salesforce:

     

    If your SaaS supports this requirement, file a feature request directly with Tableau/Salesforce to extend EPS OAuth to support dynamic instance URLs. Reference Issue #705. 

    References

     

    TACO Toolkit Documentation (EPS constraints):

    https://help.tableau.com/current/api/webdataconnector/en-us/docs/wdc_create_oauth_connector.html

     

    OneDrive Dynamic OAuth Endpoints:

    https://help.tableau.com/current/pro/desktop/en-us/examples_onedrive.htm

     

    Connector SDK OAuth Reference:

    https://tableau.github.io/connector-plugin-sdk/docs/oauth

Write an answer...
0/9000