## Set up Looker

URL: https://docs.atlan.com/apps/connectors/business-intelligence/looker/how-tos/set-up-looker

> :::warning Who can do this? You probably need your Looker administrator to run these commands - you may not have access yourself.

:::warning Who can do this?
 You probably need your Looker administrator to run these commands - you may not have access yourself.

:::

## Choose user permissions method

Atlan supports two options for user permissions in Looker. Choose one of these methods to set up Looker:

### Admin role

This role is required for Atlan to automatically generate lineage across Looker objects. When using this role, the crawler can access all folders in Looker including personal folders.

To set up this role:

1. Log in to your Looker instance and confirm that you're an Admin user.
2. From the menu in the upper left, click the **Admin** item.
3. Under the _Users_ section, click the **Users** item.
4. In the table, find the user you're logged in as. Click the **Edit** button to the right of your user's row.
5. Next to _API3 Keys_, click the **Edit Keys** button.
6. On the resulting _Edit User API3 Keys_ page, click the **New API3 Key** button.
7. Save the generated credentials for [crawling Looker](https://docs.atlan.com/llms/connectors/looker/crawl-looker/llms.txt).

### Custom role

:::warning

When using this approach, Atlan won't automatically generate lineage across Looker objects. You need to individually grant access to each folder to be included in lineage.

:::

**Create role**

To create a custom role for Atlan to access Looker:

1. Log in to your Looker instance.
2. From the menu in the upper left, click the **Admin** item.
3. Under the _Users_ section, click the **Roles** item.
4. At the top of the page, click the **New Permission Set** button.
 1. Enter a name for the new permission set.
 2. For the permissions, select the following:
 - `access_data` grants access to the other permissions below.
 - `see_lookml_dashboards` lets Atlan crawl LookML dashboards.
 - `see_looks` lets Atlan crawl Looks.
 - `see_user_dashboards` lets Atlan crawl user-defined dashboards.
 - `explore` lets Atlan fetch from the Explore page.
 - `see_sql` lets Atlan fetch the SQL of a query or Look, to generate lineage.
 - `see_lookml` lets Atlan fetch model information from LookML.
 - `develop` lets Atlan fetch connection names from models, to generate lineage.
 - `see_datagroups` lets Atlan fetch all connection names, to generate lineage.
 3. At the bottom of the permissions list, click the **New Permission Set** button.
5. Back on the _Roles_ page, at the top click the **New Role** button.
 1. Enter a name for the new role.
 2. For _Permission Set_, select the permission set you created in the previous step.
 3. For _Model Set_, select the models that you want to give access to.
 4. At the bottom of the page click the **New Role** button.

**Create user**

To create a user through which Atlan can access Looker:

1. Open the **Admin** menu in Looker.
2. Under the _Users_ section, click the **Users** item.
3. At the top of the page, click the **Add Users** button.
 1. For _Email addresses_ enter the email address for the user.
 2. For _Send setup emails_ uncheck the setting.
 3. For _Roles_ check the box next to the role you created earlier.
4. At the bottom of the page, click the **Add Users** button.
5. On the resulting page, click the **Done** button.

**Generate API key for user**

To generate an API key for the user:

1. Open the **Admin** menu in Looker.
2. Under the _Users_ section, click the **Users** item.
3. In the table, find the user created earlier. Click the **Edit** button to the right of that user's row.
4. (Optional) Consider entering a _First Name_ and _Last Name_ for the user to make it easier to recognize and find in the future.
5. Next to _API3 Keys_, click the **Edit Keys** button.
6. On the resulting _Edit User API3 Keys_ page, click the **New API3 Key** button.
7. Save the generated credentials for [crawling Looker](https://docs.atlan.com/llms/connectors/looker/crawl-looker/llms.txt).

**Include folders for lineage**

To include folders when using a custom role, give permission using the following steps:

1. From the Looker menu in the upper left, click the **Admin** item.
2. Under the _Users_ section, click the **Content Access** item.
3. In the resulting page next to _Folders_ select the folder and then click on the **Manage Access...** button.
4. In the blank box at the bottom of the table, select the user created earlier from the list.
 - To let Atlan crawl only dashboards, enable the _View_ permission for this user.
 - To let Atlan crawl tiles and queries for dashboards, enable the _Manage Access, Edit_ permission for this user.
5. To the right of the row for that user, click the **Add** button.
6. At the lower-right of the dialog, click the **Save** button.

:::warning

You need to repeat these steps for _every_ folder you want Atlan to be able to access.

:::

## Configure lineage access

In addition to user permissions, you can set up access to your project files in GitHub to generate field-level and cross-project lineage from Looker, and to crawl Looker views and build upstream lineage for views and explores. Choose one of the following methods:

### SSH

:::warning Who can do this?
 Any user with access to the Looker project files in GitHub can set up this part. You need to share the generated private key with whoever [sets up the Looker crawler](https://docs.atlan.com/llms/connectors/looker/crawl-looker/llms.txt) in Atlan. If your organization uses single sign-on (SSO) on GitHub, you must first authorize the SSH key for use with SSO. Refer to [Authorizing an SSH key for use with SAML single sign-on](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-an-ssh-key-for-use-with-saml-single-sign-on) to complete the process.

:::

To configure an SSH key for access to GitHub project files:

1. [Create a new SSH key on your local computer](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#generating-a-new-ssh-key). For example, run the following command and enter a passphrase when prompted (or leave blank for no passphrase):

 ```
 ssh-keygen -t ed25519 -C "your_email@example.com" -f ~/.ssh/atlan_looker_lineage
 ```

2. [Copy the generated keys from your local computer](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account#adding-a-new-ssh-key-to-your-account). For example:
 - To copy the public key, run this command and copy the output:

 ```
 cat ~/.ssh/atlan_looker_lineage.pub
 ```

 - To copy the private key, run this command and copy the output:

 ```
 cat ~/.ssh/atlan_looker_lineage
 ```

3. In the upper-right corner of any GitHub page, click your profile photo, then click **Settings**.
4. Under the _Access_ section of the left sidebar, click **SSH and GPG keys**.
5. In the upper-right, click the **New SSH key** button: 
 1. For _Title_ enter a descriptive label for the new key. For example, **Atlan Lineage**.
 2. For _Key_ paste in the public key you copied earlier.
 3. At the bottom of the form, click the **Add SSH key** button.
6. If prompted, enter your GitHub password and click **Confirm password**.

### HTTPS

As an alternative to SSH keys, you can use HTTPS token-based cloning to access your Looker project Git repositories. This method requires a Git username and an access token from your Git provider.

:::note Release testing scope

HTTPS token-based cloning has been fully tested with GitLab. Other Git providers may work but haven't been verified.

:::

To set up HTTPS token-based cloning:

1. Generate an access token from your Git provider with read access to the repositories containing your Looker project files. For example, in GitLab, create a [group access token](https://docs.gitlab.com/user/group/settings/group_access_tokens/#create-a-group-access-token) with the `read_repository` scope and the **Reporter** role.
2. Note the Git username for your token. If your Git provider doesn't require a specific username, use `oauth2` as the default. For GitLab group access tokens, the username is automatically generated when the token is created.
3. Save the Git username and token for use when [crawling Looker](https://docs.atlan.com/llms/connectors/looker/crawl-looker/llms.txt). Provide a fresh, valid token when configuring the workflow—the connector uses the token as-is for the duration of the crawl job and doesn't refresh or create a new one.

---