Setting up SSO with GSuite

Enterprise Feature

This guide describes a feature of the dbt Cloud Enterprise plan. If you’re interested in learning more about an Enterprise plan, contact us at

dbt Cloud Enterprise supports Single-Sign On (SSO) via Google GSuite. You will need permissions to create and manage a new Google OAuth2 application, as well as access to enable the Google Admin SDK. Gsuite is a component within Google Cloud Platform (GCP), so you will also need access to a login with permissions to manage the GSuite application within a GCP account.

Some customers choose to use different cloud providers for User and Group permission setup than for hosting infrastructure. For example, it's certainly possible to use GSuite to manage login information and Multifactor Authentication (MFA) configuration while hosting data workloads on AWS.

Currently supported features include:

  • SP-initiated SSO
  • Just-in-time provisioning

This guide outlines the setup process for authenticating to dbt Cloud with Google GSuite.

Configuration of the GSuite organization within GCP

dbt Cloud uses a Client ID and Client Secret to authenticate users of a GSuite organization. The steps below outline how to create a Client ID and Client Secret for use in dbt Cloud.

Creating credentials

  1. Navigate to the GCP API Manager
  2. Select an existing project, or create a new project for your API Credentials
  3. Click on Create Credentials and select OAuth Client ID in the resulting popup
  4. Google requires that you configure an OAuth consent screen for OAuth credentials. Click the Configure consent screen button to create a new consent screen if prompted.
  5. On the OAuth consent screen page, configure the following settings (Google docs):
Application typeinternalrequired
Application namedbt Cloudrequired
Application logoDownload the logo hereoptional
Authorized domainsgetdbt.comIf deploying into a VPC, use the domain for your deployment
Scopesemail, profile, openidThe default scopes are sufficient
GSuite Consent Screen configuration

GSuite Consent Screen configuration

  1. Save the Consent screen settings to navigate back to the Create OAuth client id page.
  2. Use the following configuration values when creating your Credentials:
Authorized URIs

If you are deploying dbt Cloud into a VPC, you should use the hostname where the dbt Cloud application is deployed instead of in the Authorized Javascript origins and Authorized Redirect URIs configurations.

Application typeWeb application
Namedbt Cloud
Authorized Javascript origins
Authorized Redirect URIs
GSuite Credentials configuration

GSuite Credentials configuration

  1. Press "Create" to create your new credentials. A popup will appear with a Client ID and Client Secret. Write these down as you will need them later!

Enabling the Admin SDK

dbt Cloud requires that the Admin SDK is enabled in this application to request Group Membership information from the GSuite API. To enable the Admin SDK for this project, navigate to the Admin SDK Settings page and ensure that the API is enabled.

The 'Admin SDK' page

The 'Admin SDK' page

Configuration in dbt Cloud

To complete setup, follow the steps below in the dbt Cloud application.

Enable GSuite Native Auth (beta)

  • For users accessing dbt Cloud at, contact your account manager to gain access to the GSuite Native auth configuration UI
  • For users accessing dbt Cloud deployed in a VPC, enable the native_gsuite feature flag in the dbt Cloud admin backend.

Supply your OAuth Client ID and Client Secret

  1. Navigate to the Enterprise > Single Sign On page under Account Settings.
  2. Click the Edit button and supply the following SSO details:
    • Log in with: GSuite
    • Client ID: Paste the Client ID generated in the steps above
    • Client Secret: Paste the Client Secret generated in the steps above
    • Domain in GSuite: Enter the domain name for your GSuite account (eg. Only users with an email address from this domain will be able to log into your dbt Cloud account using GSuite auth. Optionally, you may specify a CSV of domains which are all authorized to access your dbt Cloud account (eg.,
    • Slug: Enter your desired login slug. Users will be able to log into dbt Cloud by navigating to<login-slug>. Login slugs must be unique across all dbt Cloud accounts, so pick a slug that uniquely identifies your company.
      GSuite SSO Configuration

      GSuite SSO Configuration

  3. Click Save & Authorize to authorize your credentials. You should be dropped into the GSuite OAuth flow and prompted to log into dbt Cloud with your work email address. If authentication is successful, you will be redirected back to the dbt Cloud application.
  4. On the Verify SSO Credentials page, verify that a groups entry is present, and that it reflects the groups you are a member of in GSuite. If you do not see a groups entry in the IdP attribute list, consult the Troubleshooting steps below.
    GSuite SSO Verification

    GSuite SSO Verification

If the verification information looks appropriate, then you have completed the configuration of GSuite SSO. Members of your team should now be able to log into the dbt Cloud application at<login-slug>.

Setting up RBAC

Now you have completed setting up SSO with GSuite, the next steps will be to set up RBAC groups to complete your access control configuration.


OAuth errors

If OAuth verification does not complete successfully, double check that:

  • The Admin SDK is enabled in your GCP project
  • The Client ID and Client Secret provided match the values generated in the GCP Credentials page
  • An Authorized Domain was provided in the OAuth Consent Screen configuration If authentication with the GSuite API succeeds but you do not see a groups entry on the Verify SSO Credentials page, then you may not have permissions to access Groups in your GSuite account. Either request that your GSuite user is granted the ability to request groups from an administrator, or have an administrator log into dbt Cloud and authorize the GSuite integration.