The end user can publish a workbook or data source from Tableau Desktop with embedded credentials or for the end user to be prompted for credentials.
In this case the 'Run As' user should not need credentials to the datasource.
More info here: Tableau Server Database Log-Ins | Tableau Software
John - I'm interested in knowing more about how you used tabcmds to refresh extracts with different AD service accounts.
I have a similar situation in which I need the ability to refresh extracts with different service accounts.