2 Replies Latest reply on Feb 21, 2018 3:10 AM by Steve Wood

    What OS permissions does TABCMD require?

    Steve Wood

      Hi there,

       

      We have a handful of Windows command line batch files to run a number of TABCMD steps that: login; refresh an extract; get packaged workbook; copy packaged workbook to a file share (for use in Tableau Reader).

       

      In each case the login uses an Active Directory user that has been setup with admin rights within Tableau Server: tableauadmin

       

      The batch file itself is then run by myself manually (right click, run as admin) or via Windows task scheduler as a specific user. Until recently the scheduled batch files were running as a overarching admin user: scheduledtask

       

      (NB: usernames have been changed to protect the innocent ;-)

       

      One of our systems engineers is having me play around with other users so we're trying to change the scheduled tasks over to run as the tableauadmin user rather than the overarching scheduledtask user.

       

      Unfortunately that is causing us issues. The tableauadmin user has access to the folders where the workbooks are being extracted to. But I'm getting a completed batch job without the extract actually being refreshed, or a new version extracted. I'm logging the output of the batch job and seeing "Your session has expired. signing in again..." messages when running as tableauadmin which I didn't see when running as scheduledtask.

       

      I've tried a version of the batch file / TABCMD steps where I specify the username/password each time along with the --no-cookie option with no joy - same session expired message.

       

      The job works when I run it manually (having OS admin permissions I think) or as scheduledtask (the overarching admin user), but doesn't work when run as tableauadmin. Remember that regardless of the OS user being used I'm always logging into Tableau Server as the same user so I don't think it's a permissions thing within Tableau Server itself. Instead I'm thinking that there are some OS permissions not setup. Hence the question in the discussion title - what OS permissions are needed? I'd love to be pointed at a doc that outlines these (I did try searching first). Having said all that, if I'm asking the wrong question altogether and this is nothing to do with OS permissions please do say!

       

      Any help is appreciated! I could push to revert to the working user. Or I could push to just get wider admin rights given to the user I'm using. But I'd love to be able to explain why I'm asking for that as the engineer isn't on the wrong track by asking if we can move to a user with less privileges.

        • 1. Re: What OS permissions does TABCMD require?

          Hiya Steve,

           

          Permissions for Tabcmd and Tabadmin are set by Tableau Server. If the user has access to do a extract refresh in Tableau Server, they will have the ability to do that in Tabcmd.

          Check out the article for more info: How to Use tabcmd

           

          You can think of tabcmd as just another user except it's a machine instead of a human. If a human needs permission to access a file then so will the machine. This insures the security model remains intact.

           

          Cheers, let me know if you need additional details.

           

          ----------

          Lénaïc RIÉDINGER, Global Community Engineer Tableau

          Tableau Community Forums | Knowledge Base

          If you see a Helpful or Correct response, please mark it thanks to the buttons below the targeted post!

           

          • 2. Re: What OS permissions does TABCMD require?
            Steve Wood

            Thanks Lénaïc,

             

            Just to clarify. I'm asking about the OS user that is running TABCMD, not the Tableau Server user coded into the TABCMD login statement.

             

            I'm probably not explaining myself very well there but...

            • when I run tabcmd login -s "http://blah" -u "usera" -p "passworda" myself (right click and run as admin) it works (I think I'm a local admin on the box where I'm running it).
            • when I run the very same command (i.e. same -u and -p values) from a scheduled job in Windows that is logged into the box as an admin user, it works.
            • when I run the very same command (I.e. same -u and -p values) from a scheduled job in Windows that is logged into the box as a user with less rights, it doesn't work

             

            I'm thinking that this is some sort of permission that the script or TABCMD requires to access a folder somewhere on the OS. I got our system engineers to fix the obvious things (like granting access to the folder where the extract is going and a folder I was logging to) but must be missing something. And I didn't just want to ask them to give the user full admin rights to all folders as that seemed like a rather broad brush solution that I should check is really necessary first.

             

            Ta,

            Steve.