feat: add Workload Identity Federation (WIF) support to connection update

[sushmasreedharan-tableau]

Motivation

Tableau Server REST API 3.30 (Tableau Server release 26.3) adds
Workload Identity Federation (WIF) support to the Update Connection
endpoints via two new <connection> attributes: workgroupAuthMode and
authFederationServiceAccount. TSC currently has no way to set these,
so Python callers against a WIF-enabled 3.30+ site can't programmatically
switch a workbook, data source, or flow connection to WIF (e.g.
Snowflake or Google BigQuery) without hand-rolling raw REST calls.

Behavior change

Additive, opt-in, backward compatible. For users:

• ConnectionItem gains two new string properties:
  workgroup_auth_mode and auth_federation_service_account.
• ConnectionItem.WorkgroupAuthMode is a new nested value set:
  • ConnectionItem.WorkgroupAuthMode.WIF = "workload-identity-federation" — direct WIF (e.g. Snowflake)
  • ConnectionItem.WorkgroupAuthMode.WIF_IMPERSONATION = "workload-identity-federation-impersonation" — impersonation WIF (e.g. Google BigQuery)
• workbooks.update_connection / datasources.update_connection /
  flows.update_connection emit both attributes on the <connection>
  payload when the corresponding ConnectionItem fields are set.
  Unset fields are not emitted, so existing callers see no payload
  change.
• workbooks.update_connections / datasources.update_connections
  (bulk) accept matching workgroup_auth_mode and
  auth_federation_service_account keyword arguments and apply them
  to every connection LUID in the request.
• ConnectionItem.from_response parses the two attributes defensively
  (REST 3.30 does not echo them on GET today, so parsed values are
  typically None — the parse is forward-compatible with any future
  server echo).

Usage rules the server enforces (TSC is permissive and relies on
server-side validation):

• Resend workgroup_auth_mode on every subsequent update of a WIF
  connection; omitting it on a later update returns HTTP 400.
• Leave auth_type unset (or "oauth") when sending a WIF mode; the
  server derives the stored auth type from the mode.
• Set auth_federation_service_account only with the impersonation
  mode. The server rejects a service account alongside the direct WIF
  mode.

Compatibility:

• Requires Tableau Server REST API 3.30+ (Tableau Server release
  26.3) with WIF configured and enabled on the site for the attributes
  to take effect. Older servers silently ignore unknown connection
  attributes, so leaving these fields unset is safe on pre-3.30
  targets.
• No endpoint @api version decorator changes — this matches TSC's
  established pattern for additive attribute support on existing
  endpoints.

CHANGELOG entry added under Unreleased.

Test plan

New unit tests, all mocked (no live server), cover both WIF modes
across all three endpoints:

• test/test_workbook.py — parametrized test_update_connection_wif[direct|impersonation],
  test_update_connection_wif_switch_from_oauth,
  test_update_connection_wif_cleared_fields_omit_attrs,
  test_update_connection_wif_service_account_without_mode,
  test_update_connection_wif_from_response,
  test_update_connection_wif_from_response_absent, and parametrized
  test_update_workbook_connections_wif[direct|impersonation] for the
  bulk endpoint.
• test/test_datasource.py — identical shape against datasource
  endpoints.
• test/test_flow.py — test_update_connection_wif exercising the
  shared Connection.update_req reach through the flow endpoint.

Each singular test populates a ConnectionItem with the new fields,
calls update_connection, and asserts against the serialized request
XML — verifying both that the attributes are emitted with the exact
spelling (workgroupAuthMode / authFederationServiceAccount) and
that authFederationServiceAccount is absent in direct (non-impersonation)
mode. Bulk tests assert the same on the single <connection> payload
emitted for the whole LUID list. The from_response tests assert that
WIF attrs are parsed when the server does echo them and are None
when it does not.

Baselines still pass: test_odata_connection, test_update_connections,
and test_update_connections_without_auth_type — the additive .get()
calls in from_response degrade cleanly to None on response XML
without the new attributes.

black --check --line-length 120 and mypy tableauserverclient/
clean. pytest -n0 test/test_workbook.py test/test_datasource.py test/test_flow.py test/test_connection_.py — 164 passed.

Attribute spellings and value strings verified against the
authoritative REST API 3.30 schema and the server-side bindings for
the Update Connection endpoints. Not exercised end-to-end against a
live 3.30 server in this PR.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Bulk update_connections endpoints do not yet serialize the advertised WIF fields.

1 open finding

• Bulk connection updates lack advertised WIF field support · New

What changed in this PR

Adds Workload Identity Federation support for singular workbook and datasource connection updates.

Changes:

• Adds WIF fields and public constants.
• Serializes WIF attributes for singular updates.
• Adds response parsing, tests, fixtures, exports, and changelog documentation.

File	Summary
test/​test_workbook.py	Tests workbook WIF updates.
test/​test_datasource.py	Tests datasource WIF updates.
test/​assets/​workbook_update_connection_wif.xml	Workbook WIF fixture.
test/​assets/​datasource_update_connection_wif.xml	Datasource WIF fixture.
tableauserverclient/​server/​request_factory.py	Serializes WIF attributes for singular updates.
tableauserverclient/​models/​connection_item.py	Adds WIF fields and response parsing.
tableauserverclient/​models/​__init__.py	Re-exports WIF constants.
tableauserverclient/​__init__.py	Exports WIF constants.
CHANGELOG.md	Documents WIF support.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sushmasreedharan-tableau]

Addressed in 3e70623.

Both Datasource.update_connections_req and Workbook.update_connections_req now accept workgroup_auth_mode and auth_federation_service_account kwargs and emit them on the single <connection> payload sent for the LUID list. The matching bulk endpoint methods (workbooks.update_connections / datasources.update_connections) thread those kwargs through, and the parametrized test_update_{workbook,datasource}_connections_wif[direct|impersonation] tests assert the emitted attributes.

Also, in the same commit:

• Nested the WIF value set under ConnectionItem.WorkgroupAuthMode and dropped the two WORKGROUP_AUTH_MODE_WIF* module-level exports (prior review feedback on namespacing).
• Added a docstring note on flows.update_connection clarifying that WIF fields reach the request via the shared Connection.update_req builder, with the caveat that server-side flow handling may differ.
• Added test_update_connection_wif_switch_from_oauth, test_update_connection_wif_cleared_fields_omit_attrs, test_update_connection_wif_service_account_without_mode, test_update_connection_wif_from_response, and test_update_connection_wif_from_response_absent on both workbook and datasource test suites, plus a new test_update_connection_wif on test_flow.py.

[sushmasreedharan-tableau]

Pushed three commits addressing the inline review feedback:

5507895 — fix: use googlebigquery and add WIF response attrs in test assets

• test/assets/datasource_update_connection_wif.xml: switched type="bigquery" to the current connector class type="googlebigquery".
• Both WIF test asset XMLs: dropped the broken xsi:schemaLocation="…/ts-api_3_30.xsd" (that URL 404s) and added authenticationType="oauth", workgroupAuthMode="…", and (for impersonation) authFederationServiceAccount="…" so the fixtures match a plausible WIF-configured server response.

3e70623 — feat: nest WIF value set under ConnectionItem and extend to bulk and flows

• ConnectionItem.WorkgroupAuthMode.WIF / WIF_IMPERSONATION as a nested value set; dropped the two WORKGROUP_AUTH_MODE_WIF* module-level re-exports from tableauserverclient/__init__.py and tableauserverclient/models/__init__.py.
• Bulk endpoints: both Datasource.update_connections_req and Workbook.update_connections_req builders in request_factory.py now accept workgroup_auth_mode and auth_federation_service_account kwargs and emit them on the single <connection> payload. The workbooks.update_connections and datasources.update_connections endpoint methods thread the kwargs through, with docstrings covering the new parameters.
• Flows: added a docstring paragraph on flows.update_connection noting that WIF fields reach the request via the shared Connection.update_req builder, with the caveat that server-side flow handling may differ.
• Expanded tests on test_workbook.py and test_datasource.py: parametrized test_update_connection_wif[direct|impersonation], plus test_update_connection_wif_switch_from_oauth, test_update_connection_wif_cleared_fields_omit_attrs, test_update_connection_wif_service_account_without_mode, test_update_connection_wif_from_response, test_update_connection_wif_from_response_absent, and parametrized test_update_{workbook,datasource}_connections_wif[direct|impersonation] for the bulk path. Added test_update_connection_wif on test_flow.py.

f2bad9b — docs: expand WIF guidance in CHANGELOG

• Rewrote the Unreleased WIF entry to name the nested value set, list all five WIF-emitting endpoints, and state the usage rules explicitly: resend workgroup_auth_mode on every subsequent update (server returns HTTP 400 otherwise), leave auth_type unset or "oauth", pair auth_federation_service_account only with WIF_IMPERSONATION, and note that the server does not echo these attributes on GET today so parsed values are typically None.
• Clarified "3.30+" is the REST API version shipping with Tableau Server release 26.3, and that older servers silently ignore unknown connection attributes (so leaving these fields unset is safe on pre-3.30 targets).
• PR description updated with the same accuracy improvements.

Local: black --check --line-length 120 and mypy tableauserverclient/ clean; pytest -n0 test/test_workbook.py test/test_datasource.py test/test_flow.py test/test_connection_.py — 164 passed.