Skip to main content
Last updated on

Configure authentication to Google Workspace

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Google Workspace from the Previews page. See Manage Databricks previews.

This page shows how to configure Google Workspace to enable authentication from Databricks for the Google Workspace connector. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Databricks.

Prerequisites​

  • A Google Workspace account with the Admin SDK Reports API. The connector reads audit activity from multiple Google Workspace applications through the Google Admin SDK Reports API.
  • Super Admin access to the Google Workspace Admin console to authorize OAuth scopes.
  • A Google Cloud project in which to create an OAuth client. See Create OAuth 2.0 credentials.

Configure Google Workspace​

The Google Workspace connector authenticates using user authorization (3-legged OAuth). A Google Workspace Super Admin authorizes access to the Admin SDK Reports API audit-readonly scope, enabling the connector to read audit logs across multiple applications.

Create an OAuth client​

  1. Go to the Google Cloud console.
  2. Select or create a project.
  3. Go to APIs & Services > Library, search for "Admin SDK API", select it, then select Enable.
  4. Go to APIs & Services > Credentials.
  5. Click + Create Credentials > OAuth client ID.
  6. Select Web application as the application type.
  7. Enter a name (e.g., "Databricks Lakeflow Connect").
  8. Under Authorized redirect URIs, add the Databricks OAuth redirect URI: https://<your-databricks-workspace-url>/login/oauth/http.html. Replace <your-databricks-workspace-url> with your Databricks workspace URL (for example, https://dbc-a1b2c3d4-e5f6.cloud.databricks.com).
  9. Click Create. Your browser shows the OAuth client created dialog with your Client ID and Client Secret. Store these securely; you use them on the connection page.

Authorize the audit-readonly scope​

  1. In the Google Cloud console, go to APIs & Services > OAuth consent screen.
  2. Add https://www.googleapis.com/auth/admin.reports.audit.readonly to the scopes requested by your OAuth client.
  3. Ensure the account that authorizes the connection is a Google Workspace Super Admin. When you create the connection, this user completes the 3-legged OAuth consent and grants the audit-readonly scope.

Next steps​

Create a Google Workspace connection in Databricks. See Create a Google Workspace connection.

On this page