Tableau and Trusted Certificates for Analytics Extensions

What is a Trusted Certificate?

Starting from Tableau Server 2020.2 analytics extensions are configured with admin UI and not with TSM (more details here – Multiple Analytics Extensions Connections with Tableau Server 2020.2). And if a connection is secured (Require SSL checkbox is on) Tableau will validate certificate used by TabPy, Rserve or any other analytics extensions.

For the certificate to be trusted there are a few checks: it should be issued to the host where the analytics extensions is running, dates (valid after/before) are valid, the certificate is signed with another certificate Tableau Server trusts and some other checks. But what certificates are trusted?

Each OS ships with preinstalled trusted certificates and anything signed with any of those trusted certificates is trusted (considering all other checks mentioned above pass). Each OS has its own way of installing a trusted certificate – refer to your OS documentation.

Leaf VS Whole Chain Certificate

When analytics extension sends it certificate to Tableau it can either send the whole chain (including all the certificates it signed with) or just the very last in the chain certificate (leaf certificate).

For example, we have certificate issues for machine my-server-cert which is signed with my-org-mid-cert, which is signed with my-org-root-cert:

NOTE: number of mid-certificated can be any, but there could be rules on how deep the chain can be to not be rejected.

TabPy, if uses my-server-cert from the example above sends to Tableau the whole chain.

If the my-server-cert is installed on Tableau Desktop or Server machine as trusted – validation for it passes. Otherwise, if my-org-mid-cert is trusted – my-server-cert is trusted as well. And finally, if my-org-root-cert is trusted – my-org-mid-cert and my-server-cert are trusted. This means it is sufficient to install my-org-root-cert as trusted on the Tableau machine to make the whole chain trusted.

Rserve, when configured to use the same certificate as on the example above only sends to Tableau leaf cert – meaning only my-server-cert. This means for Tableau to trust the certificate my-server-cert has to be installed as trusted.

Self-signed Certificates

Self-signed are certificates which are not signed with any other certificate.

For self-signed certificates to be trusted they need to be installed on the client machine (machine which runs Tableau Desktop or Server).

Share the post if you liked it

How to use Python modules for TabPy scripts in Tableau

TabPy supports deployed functions which are recommended way for reusing Python code, creating and sharing models and moving code form SCRIPT_... calculated fields outside of workbooks. However when working or experimenting with code it is not very convenient if you’ll have to deploy new version of a function with every change. And this is why you may have a question if it is possible just to invoke some code from standalone Python file.

And it is possible! Let me show you how.

The files with Python function(s) in them should be on the same machine where your instance of TabPy is running. Let’s create simple file with couple of simple functions in it:

def my_add_lists(list1, list2):
    return [x + y for x, y in zip(list1, list2)]

def my_inc_list_items(list1):
    return [x + 1 for x in list1]

For Python to be able to find the module ( file) we need to set up environment variable PYTHONPATH. As explained in Python documentation ( PYTHONPATH augments where Python is looking for modules when they are referenced with import. The variable needs to be set before TabPy is started.

For Windows the variable can be set in command line:

set PYTHONPATH=%PYTHONPATH%;<my-python-functions-folder>

where <my-python-functions-folder> is the path to where your Python module(s) are located, e.g.:

set PYTHONPATH=%PYTHONPATH%;c:\user\ogolovatyi\python\tabpy-experiments

For Linux and Mac the variable can be set similarly:

export PYTHONPATH=$PYTHONPATH:<my-python-functions-folder>

Now in calculated fields you can import the modules and use functions from them. For example:

from my_python_functions import my_add_lists

return my_add_lists(_arg1, _arg2)
SUM([Price]), SUM([Tax])

In the example above from my_python_functions import my_add_lists tells Python to load my_python_functions module (which will be file in the folder we previously added to PYTHONPATH) and load my_add_lists function from it.

After that the function is used in the calculation.

Hope this simple example is helpful for you when working on Python code to be used in Tableau calculations.

Share the post if you liked it

TabPy v1.1.0 released

TabPy version 1.1.0 is released: package –, release on GitHub –

You can update your TabPy with the following command (you’ll need to stop all running TabPy instances first):

pip install --upgrade tabpy

New release main improvement is for /info method ( – now it checks for credentials to be provided if TabPy is configured for authentication. The improvement won’t affect any older Tableau Desktop or Tableau Server versions which already had support for TabPy authentication.

For how to configure authentication for TabPy read How to configure TabPy with authentication and use it in Tableau.

Share the post if you liked it

Multiple Analytics Extensions Connections with Tableau Server 2020.2

Tableau Server 2020.2 is released ( and among many new features and improvements, there is one which is specifically related to what this blog is about.

With this improvement, it is possible now to have multiple connections for one server (one connection per site) – TabPy, Rserve,, AtlTabPy, MatLab version of TabPy, etc. This allows organizations to have different analytics extensions per department or user role.

Multiple Analytics Extensions (former External Services) connections feature is explained as:

Server administrators can now configure multiple Analytics Extension (formerly External Service) connections in Tableau Server. Administrators can set one per site through the Settings UI and turn connections on or off at the Site level. Now teams using different R, Python, and other external data science environments can share their work with consumers across the same Server. Settings are easier than ever to configure with UI controls or via the Server REST API.

We will look at REST API some other time and in this post I just want to show you how to configure a connection for a site. Tableau documentation for the configuration is at

It is important to understand that web UI or REST API are now the only way to enable, disable and configure analytics extensions – TSM doesn’t provide that functionality anymore.

To enable analytics extensions feature which is disabled by default you need to be a server administrator. The screenshot below shows how to enable the feature for the whole server:

Make sure you are configuring All Sites, go to Setting, Extensions tab, set Enable analytics extension checkbox and click Save.

With the feature enabled for a server now you can configure a connection for each specific site. To be able to do so you need to be a site administrator. The next screenshot demonstrates how a connection can be configured:

Select the site you want to configure (on the screenshot it is TabPy Site), go to Settings, Extensions tab, set Enable analytics extension for site checkbox and configure a connection with setting Connection Type, Host, and Port. Set Require SSL and authentication parameters as needed (read How to configure TabPy with authentication and use it in Tableau for authentication configurations steps) and click Save button.

With the configuration successfully saved all the workbooks published on the site will use the configured connection. For workbooks on other sites connection from that site (if configured at all) will be used.

Share the post if you liked it

How to run TabPy with Anaconda on Linux

What Anaconda is can be explained in many ways depending on how and what you use is for. In the case of TabPy Anaconda serves as Python environments manager which allows having different Python environments (different versions of Python with a different set of packages) on the same machine. To learn more about Anaconda and where it can be used to start at

First question to ask is why you may need to use Python environments. There are many reasons. Couple of the most important are:

  • Your OS may have old version of “system wide” Python (e.g. Python 2.7) and it is not easy (or not possible at all) to update it without breaking something, and
  • You may want to isolate TabPy environment with packages it needs from your other environment (development, training models, etc.), or
  • You may want to have multiple independent TabPy instances each with their own set of packages awailable.

To manage Python environments Anaconda is not the only option, you can use Python virtualenv tools for example – However Anaconda has some advantages like nice UI app to manages environments and packages, saving/restoring/sharing enviroments, support for R environments, etc.

And when for Windows and Mac you can use UI app in many cases for Linux GUI is not an option. In other words you will need to use command line. And this is what rest of this post shows how to do.

After login to a Linux machine, you need to download Anaconda installer from The following commands assume you are in your home folder (run cd ~ to navigate to your home folder). On the Anaconda distribution page find the link for the latest version for Linux and run the following command:


Now when you have the installer in your home folder run it:


When the installer finishes add path to the Anaconda to the environment variable (this assumes bash is your Linux shell):

echo 'export PATH="~/anaconda3/bin:$PATH"' >> ~/.bashrc

In the command above we add anaconda3 subfolder bin from the user home folder to environment variable PATH so anaconda commands can be found regardless of what is the current folder. If you installed Anaconda in a different location the command need to be modified properly.

Now let’s restart shell (or you can unlog and log in again):

source ~/.bashrc

Next let’s update Anaconda:

conda update conda

In the command above conda is the tool which will let us perform different Anaconda operations.

Next step is to create new environment for TabPy:

conda create --name TabPy python=3.7

What happens in the command above is new environment with name TabPy is created and it has Python 3.7 available for it.

You can have as many environments as you need with different or the same Python versions. As all of them are isolated and do not interfere it is possible to have different sets of packages or the same packages of different versions in them.

Now we can activate the environment:

conda activate TabPy

If the command succeeds you’ll the command prompt is updated to have the environment name in it.

And now you can install TabPy and other packages:

python -m pip install --upgrade
pip install tabpy

To exit from the environment run deactivate command:

conda deactivate

For how to configure TabPy read

Share the post if you liked it