This guide describes a feature of the dbt Cloud Enterprise plan. If you’re interested in learning more about an Enterprise plan, contact us at firstname.lastname@example.org.
dbt Cloud Enterprise supports Single-Sign On (SSO) via Google GSuite. You will need permissions to create and manage a new Google OAuth2 application, as well as access to enable the Google Admin SDK. Gsuite is a component within Google Cloud Platform (GCP), so you will also need access to a login with permissions to manage the GSuite application within a GCP account.
Some customers choose to use different cloud providers for User and Group permission setup than for hosting infrastructure. For example, it's certainly possible to use GSuite to manage login information and Multifactor Authentication (MFA) configuration while hosting data workloads on AWS.
Currently supported features include:
- SP-initiated SSO
- Just-in-time provisioning
This guide outlines the setup process for authenticating to dbt Cloud with Google GSuite.
Configuration of the GSuite organization within GCP
dbt Cloud uses a Client ID and Client Secret to authenticate users of a GSuite organization. The steps below outline how to create a Client ID and Client Secret for use in dbt Cloud.
- Navigate to the GCP API Manager
- Select an existing project, or create a new project for your API Credentials
- Click on Create Credentials and select OAuth Client ID in the resulting popup
- Google requires that you configure an OAuth consent screen for OAuth credentials. Click the Configure consent screen button to create a new consent screen if prompted.
- On the OAuth consent screen page, configure the following settings (Google docs):
|Application name||dbt Cloud||required|
|Application logo||Download the logo here||optional|
|Authorized domains||If deploying into a VPC, use the domain for your deployment|
|Scopes||The default scopes are sufficient|
- Save the Consent screen settings to navigate back to the Create OAuth client id page.
- Use the following configuration values when creating your Credentials:
If you are deploying dbt Cloud into a VPC, you should use the hostname where
the dbt Cloud application is deployed instead of
|Application type||Web application|
|Authorized Redirect URIs|
- Press "Create" to create your new credentials. A popup will appear with a Client ID and Client Secret. Write these down as you will need them later!
Enabling the Admin SDK
dbt Cloud requires that the Admin SDK is enabled in this application to request Group Membership information from the GSuite API. To enable the Admin SDK for this project, navigate to the Admin SDK Settings page and ensure that the API is enabled.
Configuration in dbt Cloud
To complete setup, follow the steps below in the dbt Cloud application.
Enable GSuite Native Auth (beta)
- For users accessing dbt Cloud at cloud.getdbt.com, contact your account manager to gain access to the GSuite Native auth configuration UI
- For users accessing dbt Cloud deployed in a VPC, enable the
native_gsuitefeature flag in the dbt Cloud admin backend.
Supply your OAuth Client ID and Client Secret
- Navigate to the Enterprise > Single Sign On page under Account Settings.
- Click the Edit button and supply the following SSO details:
- Log in with: GSuite
- Client ID: Paste the Client ID generated in the steps above
- Client Secret: Paste the Client Secret generated in the steps above
- Domain in GSuite: Enter the domain name for your GSuite account (eg.
fishtownanalytics.com). Only users with an email address from this domain will be able to log into your dbt Cloud account using GSuite auth. Optionally, you may specify a CSV of domains which are all authorized to access your dbt Cloud account (eg.
- Slug: Enter your desired login slug. Users will be able to log into dbt
Cloud by navigating to
https://cloud.getdbt.com/enterprise-login/<login-slug>. Login slugs must be unique across all dbt Cloud accounts, so pick a slug that uniquely identifies your company.
- Click Save & Authorize to authorize your credentials. You should be dropped into the GSuite OAuth flow and prompted to log into dbt Cloud with your work email address. If authentication is successful, you will be redirected back to the dbt Cloud application.
- On the Verify SSO Credentials page, verify that a
groupsentry is present, and that it reflects the groups you are a member of in GSuite. If you do not see a
groupsentry in the IdP attribute list, consult the Troubleshooting steps below.
If the verification information looks appropriate, then you have completed
the configuration of GSuite SSO. Members of your team should now be able to log
into the dbt Cloud application at
Setting up RBAC
Now you have completed setting up SSO with GSuite, the next steps will be to set up RBAC groups to complete your access control configuration.
If OAuth verification does not complete successfully, double check that:
- The Admin SDK is enabled in your GCP project
- The Client ID and Client Secret provided match the values generated in the GCP Credentials page
- An Authorized Domain was provided in the OAuth Consent Screen configuration
If authentication with the GSuite API succeeds but you do not see a
groupsentry on the Verify SSO Credentials page, then you may not have permissions to access Groups in your GSuite account. Either request that your GSuite user is granted the ability to request groups from an administrator, or have an administrator log into dbt Cloud and authorize the GSuite integration.