Merge branch 'development' into jac/csv-import-privacy

Author: jacalata

.github/workflows/publish-pypi.yml

@@ -47,8 +47,8 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1  # license BSD-2
         with:
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url: https://test.pypi.org/legacy/
-          skip_existing: true
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
 
   smoke-test-pypi:
     name: Smoke test from Test PyPI

.github/workflows/run-tests.yml

@@ -13,7 +13,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.14t']
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.14t', '3.15']
 
     runs-on: ${{ matrix.os }}
 

CHANGELOG.md

@@ -11,6 +11,38 @@
   username instead of a raw slice, and the password column is replaced with
   `***` before any line reaches a log handler or the invalid-lines list.
   Fixes #1829.
+* Added Workload Identity Federation (WIF) support to the connection update
+  endpoints. `ConnectionItem` has two new string properties,
+  `workgroup_auth_mode` and `auth_federation_service_account`, that are
+  emitted on the `<connection>` payload by `workbooks.update_connection`,
+  `workbooks.update_connections`, `datasources.update_connection`,
+  `datasources.update_connections`, and `flows.update_connection`. The two
+  bulk endpoints also accept matching `workgroup_auth_mode` and
+  `auth_federation_service_account` keyword arguments and apply them to
+  every connection LUID in the request. Set `workgroup_auth_mode` to one of
+  the values on the new nested value set
+  `ConnectionItem.WorkgroupAuthMode`:
+  - `ConnectionItem.WorkgroupAuthMode.WIF` =
+    `"workload-identity-federation"` — direct WIF, e.g. Snowflake
+  - `ConnectionItem.WorkgroupAuthMode.WIF_IMPERSONATION` =
+    `"workload-identity-federation-impersonation"` — impersonation WIF,
+    e.g. Google BigQuery
+  Usage rules:
+  - Resend `workgroup_auth_mode` on every subsequent update of a WIF
+    connection; omitting it on a later update returns HTTP 400.
+  - Leave `auth_type` unset (or `"oauth"`) when sending a WIF mode; the
+    server derives the stored auth type from the mode.
+  - Set `auth_federation_service_account` only with `WIF_IMPERSONATION`.
+    The server rejects a service account with the direct `WIF` mode. TSC
+    does not validate this combination client-side.
+  - The server does not echo these attributes on GET responses today, so
+    `ConnectionItem.workgroup_auth_mode` and
+    `ConnectionItem.auth_federation_service_account` parsed from a response
+    will typically be `None` even when the connection is WIF-configured.
+  Requires Tableau Server REST API 3.30+ (Tableau Server release 26.3) with
+  WIF configured and enabled on the site. Older servers silently ignore
+  unknown connection attributes, so these fields are safe to leave unset on
+  pre-3.30 targets.
 * Bumped the urllib3 floor to 2.6.3 to pick up the fix for CVE-2026-21441
   (GHSA-38jv-5279-wg99, 8.9 High): urllib3's streaming decompression
   safeguards were bypassed when HTTP redirects were followed. TSC's manual

CONTRIBUTORS.md

@@ -4,36 +4,43 @@ The following people have contributed to this project to make it possible, and w
 
 ## Contributors
 
-* [jacalata](https://github.com/jacalata)
 * [jorwoods](https://github.com/jorwoods)
+* [jacalata](https://github.com/jacalata)
 * [t8y8](https://github.com/t8y8)
 * [bcantoni](https://github.com/bcantoni)
 * [shinchris](https://github.com/shinchris)
+* [vchavatapalli](https://github.com/vchavatapalli)
 * [vogelsgesang](https://github.com/vogelsgesang)
 * [lbrendanl](https://github.com/lbrendanl)
 * [LGraber](https://github.com/LGraber)
+* [dependabot[bot]](https://github.com/apps/dependabot)
 * [gaoang2148](https://github.com/gaoang2148)
-* [benlower](https://github.com/benlower)
 * [liu-rebecca](https://github.com/liu-rebecca)
+* [benlower](https://github.com/benlower)
 * [guodah](https://github.com/guodah)
-* [jdomingu](https://github.com/jdomingu)
 * [kykrueger](https://github.com/kykrueger)
+* [renoyjohnm](https://github.com/renoyjohnm)
+* [jdomingu](https://github.com/jdomingu)
 * [jz-huang](https://github.com/jz-huang)
 * [opus-42](https://github.com/opus-42)
-* [markm-io](https://github.com/markm-io)
-* [graysonarts](https://github.com/graysonarts)
+* [securehst](https://github.com/securehst)
 * [d45](https://github.com/d45)
-* [preguraman](https://github.com/preguraman)
+* [graysonarts](https://github.com/graysonarts)
 * [sotnich](https://github.com/sotnich)
+* [casey-crawford-cfa](https://github.com/casey-crawford-cfa)
+* [preguraman](https://github.com/preguraman)
 * [mmuttreja-tableau](https://github.com/mmuttreja-tableau)
-* [dependabot[bot]](https://github.com/apps/dependabot)
+* [vitorhonna](https://github.com/vitorhonna)
+* [TrimPeachu](https://github.com/TrimPeachu)
 * [scuml](https://github.com/scuml)
 * [ovinis](https://github.com/ovinis)
-* [FFMMM](https://github.com/FFMMM)
 * [martinbpeters](https://github.com/martinbpeters)
 * [talvalin](https://github.com/talvalin)
+* [FFMMM](https://github.com/FFMMM)
+* [Copilot](https://github.com/apps/copilot-swe-agent)
 * [dzucker-tab](https://github.com/dzucker-tab)
 * [a-torres-2](https://github.com/a-torres-2)
+* [valsarajnivea](https://github.com/valsarajnivea)
 * [nnevalainen](https://github.com/nnevalainen)
 * [mbren](https://github.com/mbren)
 * [wolkiewiczk](https://github.com/wolkiewiczk)
@@ -51,32 +58,41 @@ The following people have contributed to this project to make it possible, and w
 * [annematronic](https://github.com/annematronic)
 * [rshide](https://github.com/rshide)
 * [VathsalaAchar](https://github.com/VathsalaAchar)
-* [TrimPeachu](https://github.com/TrimPeachu)
-* [ajbosco](https://github.com/ajbosco)
+* [toomyem](https://github.com/toomyem)
+* [ma7tcsp](https://github.com/ma7tcsp)
+* [bossenti](https://github.com/bossenti)
+* [TableauKyle](https://github.com/TableauKyle)
 * [jimbodriven](https://github.com/jimbodriven)
+* [joelclark](https://github.com/joelclark)
 * [ltiffanydev](https://github.com/ltiffanydev)
 * [martydertz](https://github.com/martydertz)
 * [r-richmond](https://github.com/r-richmond)
 * [sfarr15](https://github.com/sfarr15)
+* [sparklingSky](https://github.com/sparklingSky)
 * [tagyoureit](https://github.com/tagyoureit)
 * [tjones-commits](https://github.com/tjones-commits)
 * [yoshichan5](https://github.com/yoshichan5)
 * [wlodi83](https://github.com/wlodi83)
+* [ajbosco](https://github.com/ajbosco)
+* [AlbertWangXu](https://github.com/AlbertWangXu)
 * [anipmehta](https://github.com/anipmehta)
+* [BereketBirbo](https://github.com/BereketBirbo)
 * [cmtoomey](https://github.com/cmtoomey)
+* [dxdc](https://github.com/dxdc)
+* [KulykDmytro](https://github.com/KulykDmytro)
+* [ecederstrand](https://github.com/ecederstrand)
 * [pes-magic](https://github.com/pes-magic)
 * [illonage](https://github.com/illonage)
+* [Der-Henning](https://github.com/Der-Henning)
 * [jayvdb](https://github.com/jayvdb)
 * [jorgeFons](https://github.com/jorgeFons)
 * [Kovner](https://github.com/Kovner)
 * [LarsBreddemann](https://github.com/LarsBreddemann)
 * [lboynton](https://github.com/lboynton)
+* [LehmD](https://github.com/LehmD)
 * [maddy-at-leisure](https://github.com/maddy-at-leisure)
 * [narcolino-tableau](https://github.com/narcolino-tableau)
 * [PatrickfBraz](https://github.com/PatrickfBraz)
 * [paulvic](https://github.com/paulvic)
+* [RenaSpb](https://github.com/RenaSpb)
 * [shrmnk](https://github.com/shrmnk)
-* [TableauKyle](https://github.com/TableauKyle)
-* [bossenti](https://github.com/bossenti)
-* [ma7tcsp](https://github.com/ma7tcsp)
-* [toomyem](https://github.com/toomyem)

README.md

@@ -9,14 +9,14 @@ Use the Tableau Server Client (TSC) library to increase your productivity as you
 * Create users and groups.
 * Query projects, sites, and more.
 
-This repository contains Python source code for the library and sample files showing how to use it. As of September 2024, support for Python 3.7 and 3.8 will be dropped - support for older versions of Python aims to match https://devguide.python.org/versions/
+This repository contains Python source code for the library and sample files showing how to use it. As of October 2026, support for Python 3.9 has been dropped; support for older versions of Python aims to match https://devguide.python.org/versions/
 
 To see sample code that works directly with the REST API (in Java, Python, or Postman), visit the [REST API Samples](https://github.com/tableau/rest-api-samples) repo.
 
 For more information on installing and using TSC, see the documentation:
 <https://tableau.github.io/server-client-python/docs/>
 
-To contribute, see our [Developer Guide](https://tableau.github.io/server-client-python/docs/dev-guide). A list of all our contributors to date is in [CONTRIBUTORS.md].
+To contribute, see our [Developer Guide](https://tableau.github.io/server-client-python/docs/dev-guide). A list of all our contributors to date is in [CONTRIBUTORS.md](CONTRIBUTORS.md).
 
 ## License
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Ftableau%2Fserver-client-python.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Ftableau%2Fserver-client-python?ref=badge_large)

getcontributors.py

@@ -1,9 +1,46 @@
-import json
+import os
+import subprocess
+
 import requests
 
+URL = "https://api.github.com/repos/tableau/server-client-python/contributors"
+
+
+def github_token():
+    token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
+    if token:
+        return token
+    try:
+        return subprocess.check_output(["gh", "auth", "token"], text=True, stderr=subprocess.DEVNULL).strip() or None
+    except (OSError, subprocess.CalledProcessError):
+        return None
+
+
+def fetch_contributors():
+    headers = {"Accept": "application/vnd.github+json", "User-Agent": "getcontributors"}
+    token = github_token()
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+
+    contributors = []
+    page = 1
+    while True:
+        response = requests.get(URL, headers=headers, params={"per_page": 100, "page": page}, timeout=30)
+        payload = response.json()
+        if not response.ok or not isinstance(payload, list):
+            message = payload.get("message", payload) if isinstance(payload, dict) else payload
+            raise SystemExit(f"GitHub API error {response.status_code}: {message}")
+        if not payload:
+            break
+        contributors.extend(payload)
+        if len(payload) < 100:
+            break
+        page += 1
+    return contributors
+
 
-logins = json.loads(
-    requests.get("https://api.github.com/repos/tableau/server-client-python/contributors?per_page=200").text
-)
-for login in logins:
-    print(f"* [{login["login"]}]({login["html_url"]})")
+for person in fetch_contributors():
+    login = person.get("login")
+    html_url = person.get("html_url")
+    if login and html_url:
+        print(f"* [{login}]({html_url})")

pyproject.toml

@@ -33,7 +33,7 @@ classifiers = [
 repository = "https://github.com/tableau/server-client-python"
 
 [project.optional-dependencies]
-test = ["black==26.5.1", "build", "mypy==2.3.1", "pytest>=7.0", "pytest-cov", "pytest-subtests",
+test = ["black==26.10.1", "build", "mypy==2.3.1", "pytest>=7.0", "pytest-cov", "pytest-subtests",
     "pytest-xdist", "requests-mock>=1.0,<2.0", "types-requests>=2.32.4.20250913"]
 
 [tool.setuptools.package-data]

tableauserverclient/models/connection_item.py

@@ -50,8 +50,50 @@ class ConnectionItem:
 
     database_name: str
         The name of the database for the connection.
+
+    workgroup_auth_mode: str
+        Workload Identity Federation (WIF) auth mode. Set to one of the
+        values on ``ConnectionItem.WorkgroupAuthMode`` to switch an existing
+        connection to WIF on an update. Requires Tableau Server 26.3 / REST
+        API 3.30+ with WIF configured and enabled on the site. See the
+        ``WorkgroupAuthMode`` nested class for usage notes. The server does
+        not echo this attribute on GET responses today, so values parsed
+        from a response are typically ``None``.
+
+    auth_federation_service_account: str
+        Service-account email required by the server for the
+        ``WorkgroupAuthMode.WIF_IMPERSONATION`` mode (e.g. Google BigQuery)
+        and rejected for the direct ``WorkgroupAuthMode.WIF`` mode (e.g.
+        Snowflake). Also requires REST API 3.30+. Not echoed on GET today,
+        so typically ``None`` when parsed from a response.
     """
 
+    class WorkgroupAuthMode:
+        """
+        Workload Identity Federation (WIF) auth-mode values for
+        :attr:`ConnectionItem.workgroup_auth_mode`.
+
+        Requires Tableau Server 26.3 / REST API 3.30+ with WIF configured
+        and enabled on the site. Older servers silently ignore unknown
+        connection attributes, so emitting these against an older server is
+        a no-op rather than an error.
+
+        Usage notes:
+
+        - Send ``workgroup_auth_mode`` on every subsequent update of a WIF
+          connection. Once a connection has been switched to WIF, omitting
+          the attribute on a later update returns HTTP 400.
+        - Leave :attr:`ConnectionItem.auth_type` unset (or ``"oauth"``) when
+          sending a WIF mode; the server derives the stored auth type from
+          the mode.
+        - Do not set :attr:`ConnectionItem.auth_federation_service_account`
+          with the direct ``WIF`` mode (the server rejects it). Set it only
+          with ``WIF_IMPERSONATION``.
+        """
+
+        WIF = "workload-identity-federation"
+        WIF_IMPERSONATION = "workload-identity-federation-impersonation"
+
     def __init__(self):
         self._datasource_id: str | None = None
         self._datasource_name: str | None = None
@@ -66,6 +108,8 @@ def __init__(self):
         self._query_tagging: bool | None = None
         self._auth_type: str | None = None
         self._database_name: str | None = None
+        self._workgroup_auth_mode: str | None = None
+        self._auth_federation_service_account: str | None = None
 
     @property
     def datasource_id(self) -> str | None:
@@ -106,6 +150,22 @@ def auth_type(self) -> str | None:
     def auth_type(self, value: str | None):
         self._auth_type = value
 
+    @property
+    def workgroup_auth_mode(self) -> str | None:
+        return self._workgroup_auth_mode
+
+    @workgroup_auth_mode.setter
+    def workgroup_auth_mode(self, value: str | None):
+        self._workgroup_auth_mode = value
+
+    @property
+    def auth_federation_service_account(self) -> str | None:
+        return self._auth_federation_service_account
+
+    @auth_federation_service_account.setter
+    def auth_federation_service_account(self, value: str | None):
+        self._auth_federation_service_account = value
+
     @property
     def database_name(self) -> str | None:
         return self._database_name
@@ -136,6 +196,8 @@ def from_response(cls, resp, ns) -> list["ConnectionItem"]:
                 string_to_bool(s) if (s := connection_xml.get("queryTagging", None)) else None
             )
             connection_item._auth_type = connection_xml.get("authenticationType", None)
+            connection_item._workgroup_auth_mode = connection_xml.get("workgroupAuthMode", None)
+            connection_item._auth_federation_service_account = connection_xml.get("authFederationServiceAccount", None)
             # The REST API GET /connections response uses "dbName" for the database
             # name attribute.  This is different from the publish request body, which
             # uses "databaseName" (see _add_connections_element in request_factory.py).

tableauserverclient/server/endpoint/datasources_endpoint.py

@@ -396,6 +396,8 @@ def update_connections(
         username: str | None = None,
         password: str | None = None,
         embed_password: bool | None = None,
+        workgroup_auth_mode: str | None = None,
+        auth_federation_service_account: str | None = None,
     ) -> list[ConnectionItem]:
         """
         Bulk updates one or more datasource connections by LUID.
@@ -424,6 +426,20 @@ def update_connections(
         embed_password : bool, optional
             Whether to embed the password.
 
+        workgroup_auth_mode : str, optional
+            Workload Identity Federation (WIF) auth mode. See
+            ``ConnectionItem.WorkgroupAuthMode`` for allowed values and
+            usage notes. Applied to every connection LUID in this call.
+            Requires Tableau Server REST API 3.30+ with WIF configured on
+            the site.
+
+        auth_federation_service_account : str, optional
+            Service-account email for WIF impersonation. Required with
+            ``ConnectionItem.WorkgroupAuthMode.WIF_IMPERSONATION`` and
+            rejected by the server with the direct
+            ``ConnectionItem.WorkgroupAuthMode.WIF`` mode. TSC does not
+            validate the combination client-side.
+
         Returns
         -------
         Iterable of str
@@ -438,6 +454,8 @@ def update_connections(
             username=username,
             password=password,
             embed_password=embed_password,
+            workgroup_auth_mode=workgroup_auth_mode,
+            auth_federation_service_account=auth_federation_service_account,
         )
         server_response = self.put_request(url, request_body)
         connection_items = ConnectionItem.from_response(server_response.content, self.parent_srv.namespace)

tableauserverclient/server/endpoint/flows_endpoint.py

@@ -264,6 +264,16 @@ def update_connection(self, flow_item: FlowItem, connection_item: ConnectionItem
 
         REST API: https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_flow.htm#update_flow_connection
 
+        Setting ``connection_item.workgroup_auth_mode`` and
+        ``connection_item.auth_federation_service_account`` (see
+        ``ConnectionItem.WorkgroupAuthMode``) will forward the Workload
+        Identity Federation attributes to this endpoint via the shared
+        ``RequestFactory.Connection.update_req`` builder. Server-side
+        handling of these attributes on flow connections is governed by
+        the flow endpoint and may differ from the workbook / datasource
+        endpoints — review the REST reference for flow-specific semantics
+        before relying on it in production.
+
         Parameters
         ----------
         flow_item: FlowItem