Configure authentication to Google Analytics

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Google Analytics Aggregated from the Previews page. See Manage Azure Databricks previews.

To let the Lakeflow Connect Google Analytics Aggregated connector authenticate, enable the Google Analytics Data API in a Google Cloud project and create a service account key or an OAuth client. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Azure Databricks.

Prerequisites

To use the Google Analytics Aggregated connector, you must have:

  • One or more Google Analytics 4 (GA4) properties. Note the numeric property ID of each property to ingest. To find it, see Property ID in the Google documentation.
  • The Administrator role on each property, to grant the connector's identity access. See Add, edit, and delete users and user groups in the Google documentation.
  • Access to the Google Cloud console to create a project, enable the Google Analytics Data API, and create credentials.

Configure Google Analytics

The Google Analytics Aggregated connector supports two authentication methods: a service account (OAuth 2.0 machine-to-machine) and OAuth 2.0 user-to-machine (U2M). Choose one, and follow the steps for that method.

Enable the Google Analytics Data API

Enable the Google Analytics Data API in your Google Cloud project before you create credentials.

  1. Go to the Google Cloud console and sign in.
  2. Select or create a Google Cloud project.
  3. Click APIs & Services > Library.
  4. Search for Google Analytics Data API and click it.
  5. Click Enable.

Use this option for server-to-server authentication without interactive user sign-in. A service account accesses Google Analytics in one of two ways:

  • Its own identity: The service account authenticates as itself. Grant the service account access to each property.
  • Domain-wide delegation: The service account impersonates a Google Workspace user, and Google Analytics authorizes requests against that user's property access.

Choose one. Don't complete both Grant the service account access to your properties and Configure domain-wide delegation.

Create a service account and key

For the full procedure, see Create service accounts and Create and delete service account keys in the Google Cloud documentation.

  1. In the Google Cloud console, click IAM & Admin > Service Accounts.
  2. Click Create service account.
  3. Enter a service account name and, optionally, a description.
  4. Click Done. The service account doesn't need any Identity and Access Management (IAM) roles on the project.
  5. On the Service accounts page, click the email address of the service account.
  6. Click the Keys tab.
  7. Click Add key > Create new key.
  8. Select JSON and click Create. Your browser downloads the key file. You can't download it again.
  9. Save the JSON key file securely. You enter its contents when you create the connection in Azure Databricks.

If key creation is blocked, the iam.disableServiceAccountKeyCreation organization policy constraint is enforced for the project. An organization policy administrator must exempt the project. See Create and delete service account keys.

Grant the service account access to your properties

Complete this step only if the service account authenticates as its own identity. That is, you leave User Email to Impersonate empty when you create the connection. If you use domain-wide delegation, skip to Configure domain-wide delegation instead. In that case, Google Analytics authorizes requests against the impersonated user's access, so this step has no effect.

  1. Go to Google Analytics and sign in.
  2. Click Admin.
  3. Under Property, click Access Management.
  4. Click +, then click Add users.
  5. Enter the service account's email address, in the format name@project-id.iam.gserviceaccount.com.
  6. Select the Viewer role.
  7. Click Add.
  8. Repeat for each property that the pipeline ingests.

For details, see Add, edit, and delete users and user groups in the Google documentation.

Configure domain-wide delegation

Complete this step instead of granting the service account access to have the service account impersonate a Google Workspace user who already has access to the properties. This step requires Google Workspace super admin access. For the full procedure, see Set up domain-wide delegation for a service account in the Google documentation.

  1. In the Google Cloud console, click IAM & Admin > Service Accounts, and then click the service account.
  2. Click Show advanced settings.
  3. Under Domain-wide delegation, copy the Client ID.
  4. In the Google Admin console, click Security > Access and data control > API controls.
  5. Click Manage Domain Wide Delegation, then click Add new.
  6. In the Client ID field, paste the client ID.
  7. In the OAuth Scopes field, enter https://www.googleapis.com/auth/analytics.readonly. For the tables this scope covers, see Required OAuth permissions.
  8. Click Authorize.
  9. Note the email address of the Google Workspace user to impersonate. Confirm that the user has at least the Viewer role on each property that the pipeline ingests. You enter this email in the User Email to Impersonate field when you create the connection.

Option 2: OAuth U2M

Use this option to authenticate as a Google user through an interactive sign-in flow. The connection uses that user's identity, so the user must have at least the Viewer role on each property that the pipeline ingests.

For the full procedure, see Configure the OAuth consent screen in the Google documentation.

  1. In the Google Cloud console, click Google Auth platform > Branding.
  2. If the Google Auth platform isn't configured, click Get started.
  3. Enter an app name and a user support email.
  4. Select an audience: Internal or External.
  5. Enter contact information, agree to the Google API Services User Data Policy, and finish the setup.
  6. If you selected External, add the users who sign in to the connection as test users in the Audience section.

If the app uses the External user type and its publishing status is Testing, Google issues refresh tokens that expire in 7 days. The connection then stops working until a user signs in again. See Refresh token expiration in the Google documentation.

Create an OAuth client

For the full procedure, see Create access credentials in the Google documentation.

  1. In the Google Cloud console, click Google Auth platform > Clients.
  2. Click Create client.
  3. For Application type, select Web application.
  4. Enter a name for the client.
  5. Under Authorized redirect URIs, click Add URI and enter https://<databricks-workspace-url>/login/oauth/http.html. Replace <databricks-workspace-url> with your Azure Databricks workspace URL.
  6. Click Create.
  7. Note the Client ID and Client secret. You enter these when you create the connection in Azure Databricks.

Next steps

Create a Google Analytics Aggregated connection in Azure Databricks. See Create a Google Analytics Aggregated connection.

  • Last updated on