## Enable SSO for Google BigQuery

URL: https://docs.atlan.com/apps/connectors/data-warehouses/google-bigquery/how-tos/enable-sso-for-google-bigquery

> Credentials are used to obtain an access token from Google's authorization servers for authentication in Atlan.

Atlan supports SSO authentication for [Google BigQuery](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-google-bigquery/llms.txt) connections. Once you've configured SSO authentication for Google BigQuery, your users can:

- [Query data with SSO credentials](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt)
- [View sample data with SSO credentials](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt)

:::info **Did you know?** 
 When using OAuth 2.0 for authorization, Google displays a consent screen to the user that includes a summary of your project, policies, and scopes. If you haven't configured the consent screen, complete the steps in [configure OAuth consent screen](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt). Otherwise, skip to [create access credentials](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt).

:::

## (Optional) Configure OAuth consent screen in Google BigQuery

:::warning Who can do this?
 Your Google BigQuery administrator must complete these steps; you may not have access yourself.

:::

To [configure the OAuth consent screen](https://developers.google.com/workspace/guides/configure-oauth-consent), from Google BigQuery:

1. Open the [Google Cloud console](https://console.cloud.google.com/apis/credentials/consent).
2. In the left menu of the _Google Cloud_ console, under _APIs & Services_, click **OAuth consent screen**.
3. On the _OAuth consent screen_ page, under _User Type_, select a preferred user type and then click **Create**.
4. In the corresponding _Edit app registration_ page, enter the following details: 
 1. For _App name_, enter a meaningful name - for example, `Atlan_SSO`.
 2. For _User support email_, enter a support email for your users to troubleshoot.
 3. For _Developer contact information_, enter an email address where Google can notify you about any changes to your project.
 4. Click **Save and continue** to proceed to the next step.
5. On the _Scopes_ page, complete the following steps:
 1. Click **Add or remove scopes** to add a new scope.
 2. In the _Update selected scopes_ dialog, click **BigQuery API** to add the `/auth/bigquery` scope and then click **Update**.
 3. Click **Save and continue** to finish setup.
6. Once the OAuth consent screen configuration is successful, click **Go back to dashboard**.

## Create access credentials in Google BigQuery

:::warning Who can do this?
 Your Google BigQuery administrator must complete these steps; you may not have access yourself.

:::

Credentials are used to obtain an access token from Google's authorization servers for authentication in Atlan.

To [create access credentials](https://developers.google.com/workspace/guides/create-credentials), from Google BigQuery:

1. Open the [Google Cloud console](https://console.cloud.google.com/apis/credentials).
2. In the left menu of the _Google Cloud_ console, under _APIs & Services_, click **Credentials**.
3. From the upper right of the _Credentials_ page, click **Create credentials**, and from the dropdown, click **OAuth client ID**. 
4. In the _OAuth client ID_ screen, enter the following details:
 1. For _Application type_, click **Web application**.
 2. For _Name_, enter a meaningful name - for example, `Atlan_client`.
 3. Under _Authorized JavaScript origins_, click **Add URI** and enter your Atlan instance  - for example, `https://<company-name>.atlan.com`.
 4. Under _Authorized redirect URIs_, click **Add URI** and enter your Atlan endpoint URI - for example, `https://<company-name>.atlan.com/api/service/oauth`.
 5. Click **Create** to finish setup.
5. From the corresponding _OAuth client created_ dialog, copy the _Client ID_ and _Client secret_ and store it in a secure location.

## Configure SSO authentication in Atlan

:::warning Who can do this?
 You need to be a [connection admin](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt) in Atlan to complete these steps. You also need inputs and approval from your Google BigQuery administrator.

:::

Once you have [configured access credentials in Google BigQuery](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt), you can enable SSO authentication for your users to [query data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) and [view sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) in Atlan.

To configure SSO on a Google BigQuery connection, from Atlan:

1. From the left menu of any screen, click **Assets**.
2. From the _Assets_ page, click the **Connector** filter, and from the dropdown, select **BigQuery**.
3. From the pills below the search bar at the top of the screen, click **Connection**.
4. From the list of results, select a Google BigQuery connection to enable SSO authentication.
5. From the sidebar on the right, next to _Connection settings_, click **Edit**.
6. In the _Connection settings_ dialog:
 - Under _Allow query_, for _Authentication type_, click **SSO authentication** to enforce SSO credentials for [querying data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt):
 - For _SSO authentication_, enter the following details:
 1. For _Client ID_, enter the [client ID](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt) you copied from Google BigQuery.
 2. For _Client secret_, enter the [client secret](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt) you copied from Google BigQuery.
 - Under _Display sample data_, for _Source preview_, click **SSO authentication** to enforce SSO credentials for [viewing sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt):
 - If SSO authentication is enabled for querying data, the same connection details are reused for viewing sample data.
 - If a different authentication method is enabled for querying data, enter the [client ID](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt) and [client secret](https://docs.atlan.com/llms/connectors/google-bigquery/enable-sso-for-google-bigquery/llms.txt) you copied from Google BigQuery.
7. (Optional) Toggle on **Enable data policies created at source to apply for querying in Atlan** to apply any data policies and user permissions at source to querying data and viewing sample data in Atlan. If toggled on, any existing [data policies](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt) on the connection in Atlan are deactivated and creation of new data policies is disabled.
8. At the bottom right of the _Connection settings_ dialog, click **Update**.

Your users can now [run queries](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) and [view sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) using their SSO credentials.

---