#OAuth2 discussing

Environment: Tableau Cloud, REST API 3.29, tableauserverclient (Python), Snowflake connection with authentication='oauth', oauth-config-id='default', server-oauth='server-custom'. 

ISSUE 

We publish workbooks via REST API/PAT in a CI/CD pipeline. We're trying to reproduce a connection state that Tableau Desktop can produce, but the REST API can't. 

Desktop-published state (Data Sources tab shows "Not embedded in connection"): 

auth_type='oauth' username='<user>' embed_password=False 

Our pipeline's state (REST API publish): 

auth_type='oauth' username='' embed_password=False 

The Desktop state results in viewers being prompted for their own credentials. Ours results in every viewer getting BadOAuthCredentials, since there's no username hint at all. 

WHAT WE TRIED 

Using Server.workbooks.update_connection() (PUT /workbooks/{id}/connections/{connectionId}), we tested every combination: 

1. embed_password=True + username -> credential embeds, all viewers connect silently as that one identity (no prompt). 

2. embed_password=False + blank username -> every viewer gets BadOAuthCredentials. 

3. embed_password=False + non-empty username (trying to match Desktop) -> the server silently discards the username; a follow-up GET always returns username=''. No error is returned, it just reverts. 

4. Re-embedding (embed_password=True) via update_connection without supplying a password fails outright with 404020: Resource Not Found ... This may be due to incorrect or missing credentials. There's no way to flip an OAuth connection back to embedded through this endpoint without a real credential, and OAuth connections have no password-style credential the API can supply. 

We confirmed #3 fails identically whether attempted via connections=[ConnectionCredentials(...)] at publish time, or via a separate post-publish update_connection call. Same result both ways. 

QUESTIONS 

1. Is there any documented REST API mechanism (any endpoint, any API version) to set an OAuth connection to embedPassword=false while preserving a non-empty userName hint, matching what Desktop produces? 

2. Is that "not embedded + username hint" state inherently tied to an interactive/vizportal-authenticated session (i.e. genuinely unreachable via PAT/REST), or is there an undocumented parameter/flow we're missing? 

3. Is per-viewer OAuth prompting for a Snowflake connection with oauth-config-id='default' expected to work at all when the workbook was published via REST API/PAT, or is this a Desktop-only capability? 

Happy to share full request/response payloads if that helps with diagnosis. 

#OAuth  #Tableau APIs & Embedding

#Tableau Cloud  #Tableau Server

Good afternoon, Ohana   

We are currently facing a critical issue with our monday.com Salesforce integration where data has stopped flowing from Salesforce to monday.com. We have been working with monday.com technical support, but we are still stuck at the "handshake successful but no data moving" stage.

The Current State:

• We have both the Legacy Integration and the new Salesforce Two-Way Sync App installed in our monday.com environment.
• The connection shows as "Polling Successfully" in the monday.com backend logs.
• The Connected App policies in Salesforce are configured for "Relax IP Restrictions" and "Refresh token is valid until revoked."
• Despite the successful connection, creating/updating a record in Salesforce does not trigger an item creation call in monday.com.

What we have tried/verified:

1. Change Data Capture (CDC): We have enabled CDC for the relevant objects (specifically the Case object).
2. Auth Handshake: We deleted the corrupted tokens/connections in the monday.com Autopilot hub and established a fresh connection.
3. App Transition: We attempted to move the specific workflow from the legacy integration to the new Salesforce Two-Way Sync App to rule out stale token architecture.
4. HAR Analysis: A .HAR file was captured and is currently being reviewed by support.
5. Permission Audit: The authenticating user has "offline access" and "View All" permissions for the target objects.

The specific roadblock: Even with the "Two-Way Sync" app, we are unable to successfully map the Link field (monday.com) to the Object ID (Salesforce), and Salesforce events are seemingly not reaching the monday.com listener.

Has anyone encountered a scenario where the integration is authenticated and polling, but the event-stream from Salesforce fails to initiate the creation call? Are there specific Apex Triggers or Platform Event permissions within the monday.com Managed Package that might be silently failing?

Any insight into the "polling but not creating" behavior would be greatly appreciated.    

Hi,​

​

Can you please tell me how to implement the Client function of OAuth (Resource Owner Password Credentials) in Mulesoft?

• grant_type: password

​

Http Connector only supports the following Flow.

• Authorization Code
• Client Credentials

​

Is it possible to achieve this by combining the following?

• http connector(Client Credentials)
• Component(Transform Message、Set Payload、Custom(Java/Scripting))

https://help.mulesoft.com/s/article/HTTP-Connector-do-not-support-the-OAuth-Password-Credentials-Grant-type

The password credentials grant MUST NOT be used.This grant type insecurely exposes the credentials of the resource owner.

->However, our system requires Resource Owner Password Credentials.

#http connector

• https://docs.mulesoft.com/http-connector/1.6/http-authentication
• https://docs.mulesoft.com/oauth-module/1.1/

#OAuth(Resource Owner Password Credentials)

•  https://www.ietf.org/rfc/rfc6749.txt

4.3. Resource Owner Password Credentials Grant

•  https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow
•  https://oauthlib.readthedocs.io/en/latest/oauth2/grants/password.html

Thanks,

Akihiko