5 Replies Latest reply on Jul 19, 2018 2:04 AM by Jon H

    Is there a way to generate URL prefixes in Tableau Server?

    Jon H

      I'm working with a client who is running Tableau Server, and I am entirely new to it. Tableau runs on a LAN and so content needs to be proxied from the outside of the network. To do this, it has been decided to proxy content from the internet, using a prefix in the URL of "/tableau-proxy". This is carried to the DMZ web servers, which preserve this prefix, and hand it off to LAN web servers. From here, LAN web servers proxy it again to Tableau, but strip off the URL prefix so that Tableau can make sense of the request. This will allow us to build an app that will use the JS API to render Tableau visualisations delivered within iframes.

       

      This URL rewriting and proxying uses Apache's mod_rewrite, mod_proxy and mod_proxy_http, and works fine. However, I now need Tableau to generate all its links based on the root of `/tableau-proxy` instead of the `/` default. The usual way of doing this in Apache is content rewriting using mod_proxy_html, but I am getting in a bit of a pickle with this. I may yet succeed, but I wonder if there is an easier way to achieve the same thing.

       

      Thus, I wonder if Tableau has a configuration setting that will generate all URLs based on a custom base URL? It's not terrible if this is not available, as we have other options - content rewriting is one, and creating a new subdomain is another. However, we're not sure if a subdomain is workable for us, and as I say, link rewriting seems to be fraught with difficulty. So if there's a trivial setting I have so far overlooked, that'd be great. Any ideas?

       

      We're using version 2018.1.2.

        • 1. Re: Is there a way to generate URL prefixes in Tableau Server?
          Jeff Strauss

          Let me see if I got this straight.  You have external clients that you want to provide access to your internal Tableau Server deployment?  Such as what is in this genericized picture?

           

          The way we do this is we have a load balancer that handles the incoming traffic which then forwards on the traffic to our internal Tableau Server.  There is no Apache hacking that we have to do, all links point at the load balancer, and we follow the instructions within the Tableau reverse proxy documentation.  Configuring Proxies for Tableau Server

           

          Would something like this work for your scenario?

           

          • 2. Re: Is there a way to generate URL prefixes in Tableau Server?
            Jon H

            Thanks for your reply, Jeff.

            Jeff Strauss wrote:

             

            Let me see if I got this straight. You have external clients that you want to provide access to your internal Tableau Server deployment?

            Yes, that's right.

             

            However, it's a bit more complex than that. By virtue of the available servers and infrastructure decisions that have already been taken:

             

            • we have just one fully-qualified domain to serve this project, through HTTPS (myexternal.com)
            • the root of the domain will serve a PHP-based application to control access to the Tableau instance using trusted tokens and the JavaScript API
            • we will use an Apache reverse proxy (mod_rewrite and mod_proxy) to channel Tableau traffic via a URL subfolder, /tableau-proxy
            • the Tableau instance will be freely reverse proxied to the internet, and will rely entirely on tokens for security

             

            If we do this all via Apache then:

             

            • The outermost server should proxy Tableau traffic from myexternal.com/tableau-proxy to internal-web-server/tableau-proxy (preserve the proxy subdir)
            • The innermost server should proxy Tableau traffic from internal-web-server/tableau-proxy to tableau-server/ (strip the proxy subdir)

             

            We have all of the above working reliably. However, this means that we need to do some content rewriting using mod_proxy_html, thus:

             

            • Modify links in the base Tableau HTML document from / to /tableau-proxy (we have this working)
            • Modify HTTP token redirects in Tableau from / to /tableau-proxy (this should be easy)
            • Modify JS file contents to rewrite /vizql to /tableau-proxy/vizql (this may be tricky, I'll look into "ProxyHTMLExtended" in mod_proxy_html)

             

            So, the problem I would like to solve is for Tableau itself to serve its site from /tableau-proxy rather than from the / default. I don't know if this is a setting in Tableau, and that is probably my main question - is this supported?

             

            If it is, then it would save us some configuration woes, and eliminate the content rewriting, which can be brittle in certain cases. If not, then no worries - we have other things we can try.

            • 3. Re: Is there a way to generate URL prefixes in Tableau Server?
              Jeff Strauss

              ok, besides It sounds over complicated, my hunch though is a change is required to httpd config to route to the proper sub-folder of tableau-proxy, but this is totally unsupported by Tableau support, and can become brittle in of itself and may break anytime that you try to upgrade.

               

              The way we have it setup is similar in that our external portal uses trusted tokens and the javascript api to talk with Tableau, but all external traffic goes through the nginx load balancer via (myexternal.com).  This load balancer has routing rules in it to forward the traffic on to our internal URL's (i.e. myinternal.com), and there are specific firewall rules to allow this traffic to be routed through.  Then the internal Tableau talks amongst itself using the internal URL.

              1 of 1 people found this helpful
              • 4. Re: Is there a way to generate URL prefixes in Tableau Server?
                Jon H

                Jeff Strauss wrote:

                 

                ok, besides It sounds over complicated

                Well, it's certainly complicated - proxying traffic in this sort of infrastructure is not a trivial task however it is done. However, it is not particularly unusual - IMO, the whole point of mod_proxy_html is to make content corrections.

                 

                Whether it is over complicated depends on whether there is a simpler approach that would work for us. I presently don't think there is, but am very happy to hear if you can spot one.

                 

                Jeff Strauss wrote:

                 

                this is totally unsupported by Tableau support, and can become brittle in of itself and may break anytime that you try to upgrade.

                I hear you, and thanks. I have advised my client to set up a staging proxy system so that Tableau upgrades can be tested with this system prior to their going live.

                 

                Jeff Strauss wrote:

                 

                 

                The way we have it setup is similar in that our external portal uses trusted tokens and the javascript api to talk with Tableau

                Yep, that's what we're doing.

                 

                Jeff Strauss wrote:

                 

                but all external traffic goes through the nginx load balancer via (myexternal.com). This load balancer has routing rules in it to forward the traffic on to our internal URL's (i.e. myinternal.com)

                Indeed. We're using reverse proxying in Apache for the same purpose as you're using Nginx. However, the reason for our complexity is to differentiate between our PHP web traffic (port 443 on myexternal.com) and proxied Tableau web traffic (port 443 on myexternal.com). The only way I can spot to do this is to extend the URL path.

                 

                I am presently constrained not to set up tableau.myexternal.com, which would remove the content rewriting complexity (we are not sure of the lead time of this change request, and it may have an SSL cert and IP address allocation impact). However, I will suggest it as a version 2 enhancement when the team is under less time pressure.

                 

                I suspect that in your load balancer, you are reverse-proxying Tableau on its own, which is why your configuration is a great deal simpler! Anyway, thank you again for being my sounding board - my question of whether Tableau supports this is answered.

                 

                PS - since writing the first post, we have successfully implemented all of the above, so it works - now I'll get to work on making it reliable!

                • 5. Re: Is there a way to generate URL prefixes in Tableau Server?
                  Jon H

                  Following on from my last post, we've had a bit of a rethink on this - perhaps this will be useful for other folks with the same technical restrictions.

                   

                  We're trialling reverse proxying of Tableau from / to / i.e. with no URL rewriting. Happily, this means we can dump link rewriting too, so no more mod_proxy_html!

                   

                  The web app we're deploying at the same time will be placed in a special subdir that is excepted from the proxy rules. Since this app is written by us and is entirely under our control, we can guarantee that all the links will begin with that subdir. The only minor risk is that we need to choose a subdir that Tableau will not generate in any of the URLs for its assets, content and AJAX calls, but that should be pretty easy.

                   

                  We're happy that this approach represents less risk that the earlier solution.