[sushmasreedharan-tableau]

Summary

Expose the Tableau Server WIF admin REST surface (REST API 3.30+ / Tableau Server release 2026.3) on the TSC server object as server.auth_federation. Lets a site admin manage the WIF site configuration, signing keys, and connectors from the client, and complements the per-connection WIF attributes delivered in #1887.

Scope stops at the admin surface (/sites/{siteLuid}/auth-federation/admin[/connectors|/keys]). The public .well-known endpoints (/openid-configuration, /jwks.json) and the sign-in path are consumed by Snowflake / GCP / BigQuery directly, not by TSC callers, and are intentionally out of scope for this PR.

New endpoint methods

Admin config (/sites/{siteLuid}/auth-federation/admin)

• server.auth_federation.get() -> AuthFederationItem
• server.auth_federation.enable(config) -> AuthFederationItem — idempotent PUT; requires config.enabled=True
• server.auth_federation.update(config) -> AuthFederationItem — merge-patch; only token_lifetime_seconds is sent on the wire; issuer_url, active_key_id, and connectors are server-assigned and omitted
• server.auth_federation.delete() -> None — removes the config, every signing key, and every connector on the site

Connectors (.../admin/connectors)

• server.auth_federation.create_connector(connector) -> AuthFederationConnectorItem
• server.auth_federation.list_connectors() -> list[AuthFederationConnectorItem]
• server.auth_federation.get_connector(id) — accepts LUID string or AuthFederationConnectorItem
• server.auth_federation.delete_connector(id) — accepts LUID string or AuthFederationConnectorItem; idempotent server-side

Keys (.../admin/keys)

• server.auth_federation.create_key() -> AuthFederationKeyItem — inactive by default; private key is never returned
• server.auth_federation.activate_key(id) — atomic: deactivates whichever key was previously active
• server.auth_federation.deactivate_key(id)
• server.auth_federation.delete_key(id) — HTTP 400 if the key is still active

All methods are version-gated by @api(version="3.30").

New public types

Exported from both tableauserverclient.models and the TSC top level (TSC.X):

• AuthFederationItem — admin config (enabled, issuer_url, active_key_id, token_lifetime_seconds, connectors)
• AuthFederationConnectorItem — single connector (luid, connector_class, audience)
• AuthFederationKeyItem — JWK metadata (kid, kty, alg, use, n, e)

Design notes mirrored from the server

• enable() enforces enabled=True client-side; the server also rejects enabled=false with HTTP 400 and tells callers to use DELETE instead.
• update() only emits tokenLifetimeSeconds on the wire. The server silently ignores read-only fields on PATCH; the client does the same to avoid pretending they're mutable.
• delete_connector() is idempotent server-side (returns 204 even if the connector does not exist); orphan connections that referenced the deleted connector are not cascade-deleted.
• create_key() sends only the empty <tsRequest/> envelope (POST body is empty on the Java controller side).
• activate_key() / deactivate_key() / delete_key() take the JWK kid as the URL path parameter — same value the server returns as authFederationKey@kid.

Test plan

• python -m pytest test/test_auth_federation.py — 22 new tests, all passing
• python -m pytest test/ — full suite: 977 passed, 1 pre-existing skip, 0 failures
• python -m mypy tableauserverclient — no issues in 106 source files
• python -m black tableauserverclient test — formatted
• Request-body shape asserted via defusedxml parsing of requests_mock history for every PUT / PATCH / POST method (not just string matching)
• Both "pass a str" and "pass an item" forms covered for every id-taking method
• EndpointUnavailableError verified when running against a server pinned to 3.29

🤖 Generated with Claude Code