In the context of Tableau Server, what is an important consideration when configuring access to the Metadata API for external applications?
A. Allowing unrestricted access to the Metadata API from any external application
B. Configuring the Metadata API to provide real-time updates to external applications
C. Implementing OAuth for secure, token-based authentication for external applications accessing the Metadata API
D. Ensuring external applications have direct database access for synchronized metadata retrieval
C. Implementing OAuth for secure, token-based authentication for external applications accessing the Metadata API
Explanation:
Why C is Correct?
OAuth is the industry-standard protocol for secure API access, providing token-based authentication without exposing credentials.
It enables:
Fine-grained access control (scopes/permissions).
Revocable tokens (reduce risk if compromised).
Auditability (track API usage by application).
Tableau’s Metadata API Security Guide mandates OAuth for external integrations.
Why Other Options Are Incorrect?
A. Unrestricted access: A major security risk—exposes metadata to unauthorized parties.
B. Real-time updates: Not a security consideration (and not always feasible due to performance impacts).
D. Direct database access: Bypasses Tableau’s security model—never grant direct DB access for metadata.
Key Steps for Secure Metadata API Access:
Register external apps in Tableau Server’s OAuth settings.
Define scopes (e.g., read:metadata) to limit permissions.
Rotate secrets/tokens regularly.
Reference:
OAuth 2.0 Best Practices (RFC 6749).
Final Note:
C is the only secure approach. Options A/B/D either ignore security (A/D) or confuse functionality with access control (B). Always use OAuth for APIs.