feat(ingestion/tableau): verify role assignment to user in test_connection.

metadata-ingestion/src/datahub/ingestion/source/tableau/tableau.py

@@ -255,6 +255,46 @@ def get_tableau_auth(
             )
         return authentication
 
+    def check_user_role(
+        self, server: Server
+    ) -> Dict[Union[SourceCapability, str], CapabilityReport]:
+        assert server.user_id, "make the connection with tableau"
+
+        capability_dict: Dict[Union[SourceCapability, str], CapabilityReport] = {
+            "metadataRole": CapabilityReport(
+                capable=True,
+            )
+        }
+
+        failure_reason: str = (
+            "The user does not possess the `Site Administrator Explorer` role."
+        )
+
+        mitigation_message: str = "Assign `Site Administrator Explorer` role to the user {}. Refer setup guide: https://datahubproject.io/docs/quick-ingestion-guides/tableau/setup"
+
+        try:
+            user = server.users.get_by_id(server.user_id)
+
+            # TODO: Add check for `Enable Derived Permissions`
+            if user.site_role != "SiteAdministratorExplorer":
+                capability_dict["metadataRole"] = CapabilityReport(
+                    capable=False,
+                    failure_reason=failure_reason,
+                    mitigation_message=mitigation_message.format(user.name),
+                )
+
+            return capability_dict
+
+        except Exception as e:
+            logger.warning(e)
+            capability_dict["metadataRole"] = CapabilityReport(
+                capable=False,
+                failure_reason=failure_reason,
+                mitigation_message=mitigation_message.format(""),  # user is unknown
+            )
+
+            return capability_dict
+
     def make_tableau_client(self, site: str) -> Server:
         authentication: Union[
             TableauAuth, PersonalAccessTokenAuth
@@ -654,9 +694,15 @@ def test_connection(config_dict: dict) -> TestConnectionReport:
         test_report = TestConnectionReport()
         try:
             source_config = TableauConfig.parse_obj_allow_extras(config_dict)
-            source_config.make_tableau_client(source_config.site)
+
+            server = source_config.make_tableau_client(source_config.site)
+
             test_report.basic_connectivity = CapabilityReport(capable=True)
+
+            test_report.capability_report = source_config.check_user_role(server=server)
+
         except Exception as e:
+            logger.warning(msg=e, exc_info=e)
             test_report.basic_connectivity = CapabilityReport(
                 capable=False, failure_reason=str(e)
             )

metadata-ingestion/tests/integration/tableau/test_tableau_ingest.py

@@ -21,6 +21,7 @@
 
 from datahub.emitter.mce_builder import DEFAULT_ENV, make_schema_field_urn
 from datahub.emitter.mcp import MetadataChangeProposalWrapper
+from datahub.ingestion.api.source import TestConnectionReport
 from datahub.ingestion.run.pipeline import Pipeline, PipelineContext
 from datahub.ingestion.source.tableau.tableau import (
     TableauConfig,
@@ -1272,3 +1273,89 @@ def test_permission_mode_switched_error(pytestconfig, tmp_path, mock_datahub_gra
                 "Turn on your derived permissions. See for details "
                 "https://community.tableau.com/s/question/0D54T00000QnjHbSAJ/how-to-fix-the-permissionsmodeswitched-error"
             )
+
+
+@freeze_time(FROZEN_TIME)
+@pytest.mark.integration
+def test_connection_report_test(requests_mock):
+    server_info_response = """
+        <tsResponse xmlns:t="http://tableau.com/api">
+            <t:serverInfo>
+                <t:productVersion build="build-number">foo</t:productVersion>
+                <t:restApiVersion>2.4</t:restApiVersion>
+            </t:serverInfo>
+        </tsResponse>
+
+    """
+
+    requests_mock.register_uri(
+        "GET",
+        "https://do-not-connect/api/2.4/serverInfo",
+        text=server_info_response,
+        status_code=200,
+        headers={"Content-Type": "application/xml"},
+    )
+
+    signin_response = """
+        <tsResponse xmlns:t="http://tableau.com/api">
+            <t:credentials token="fake_token">
+                <t:site id="fake_site_luid" contentUrl="fake_site_content_url"/>
+                <t:user id="fake_user_id"/>
+            </t:credentials>
+        </tsResponse>
+    """
+
+    requests_mock.register_uri(
+        "POST",
+        "https://do-not-connect/api/2.4/auth/signin",
+        text=signin_response,
+        status_code=200,
+        headers={"Content-Type": "application/xml"},
+    )
+
+    user_by_id_response = """
+        <tsResponse xmlns:t="http://tableau.com/api">
+          <t:user id="user-id" name="[email protected]" siteRole="SiteAdministratorExplorer" />
+        </tsResponse>
+    """
+
+    requests_mock.register_uri(
+        "GET",
+        "https://do-not-connect/api/2.4/sites/fake_site_luid/users/fake_user_id",
+        text=user_by_id_response,
+        status_code=200,
+        headers={"Content-Type": "application/xml"},
+    )
+
+    report: TestConnectionReport = TableauSource.test_connection(config_source_default)
+
+    assert report
+    assert report.capability_report
+    assert report.capability_report.get("metadataRole")
+    assert report.capability_report["metadataRole"].capable
+
+    # Role other than SiteAdministratorExplorer
+    user_by_id_response = """
+        <tsResponse xmlns:t="http://tableau.com/api">
+          <t:user id="user-id" name="[email protected]" siteRole="Explorer" />
+        </tsResponse>
+    """
+
+    requests_mock.register_uri(
+        "GET",
+        "https://do-not-connect/api/2.4/sites/fake_site_luid/users/fake_user_id",
+        text=user_by_id_response,
+        status_code=200,
+        headers={"Content-Type": "application/xml"},
+    )
+
+    report = TableauSource.test_connection(config_source_default)
+
+    assert report
+    assert report.capability_report
+    assert report.capability_report.get("metadataRole")
+    assert report.capability_report["metadataRole"].capable is False
+    assert (
+        report.capability_report["metadataRole"].failure_reason
+        == "The user does not possess the `Site Administrator Explorer` role."
+    )