> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/admin-configuration/admin-console/user-management/sso-for-api-usage/using-collibra-dq-as-a-proxy-to-the-idp.md).

# Using Collibra DQ as a proxy to the IdP

{% hint style="warning" %}
While this method is supported, we recommend using the [externally managed JWTs](/data-quality-self-hosted/admin-configuration/admin-console/user-management/sso-for-api-usage/configuring-an-externally-managed-jwt.md) method instead.
{% endhint %}

This method calls the IdP to retrieve the access\_token itself. Data Quality & Observability (self-hosted) has an /oath/signin endpoint, which accepts username, password, iss (tenantname) parameters. Data Quality & Observability (self-hosted) sends these inputs to the IdP to retrieve an access\_token, which Data Quality & Observability (self-hosted) then uses to extract the information it needs to create its own token.

![Image of SSO for API Usage page](https://4121921244-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWCrP7Albs8DfJjIQxUxw%2Fuploads%2Fgit-blob-79c385614267e957a6a767efd3ff22ad42398129%2Fdq-as-a-proxy-to-idp.png?alt=media)

## Steps

{% stepper %}
{% step %}
Sign in to Data Quality & Observability (self-hosted) and click <img src="https://4121921244-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWCrP7Albs8DfJjIQxUxw%2Fuploads%2Fgit-blob-268a786d787f353b92e094a60945df32bf9cb208%2FCogwheelIcon.svg?alt=media" alt="Cogwheel icon" data-size="line"> in the left navigation pane.
{% endstep %}

{% step %}
Click **Admin Console**.
{% endstep %}

{% step %}
Click **Configuration Settings**, then click **Application Config**.\ <i class="fa-chevrons-right">:chevrons-right:</i> The Application Configuration Settings page opens.
{% endstep %}

{% step %}
Set the **SSO\_API** setting to **TRUE**.
{% endstep %}

{% step %}
From the Admin Console treeview menu, click **User Management**, then **API for SSO Usage**.\ <i class="fa-chevrons-right">:chevrons-right:</i> The SSO for API Usage page opens.
{% endstep %}

{% step %}
Select the **Enable DQ Proxy to IdP** option.
{% endstep %}

{% step %}
Enter the required information.

<table><thead><tr><th width="152">Field</th><th>Description</th></tr></thead><tbody><tr><td>Enable DQ proxy to IdP</td><td>Enables SSO for APIs.</td></tr><tr><td>IdP Token URL</td><td><p>The token endpoint URL of the identity provider (IdP).</p><div data-gb-custom-block data-tag="tabs"><div data-gb-custom-block data-tag="tab" data-title="Example" data-icon="glasses-round"><p>https://&#x3C;your_domain>/oidc/2/token</p></div></div></td></tr><tr><td>Grant Type</td><td>The grant type used for authentication. Select Password.</td></tr><tr><td>Parameters</td><td><p>Static query parameters that are appended to the call to the IdP. This is typically found in the URL of the IdP and is specific to the IdP implementation.</p><div data-gb-custom-block data-tag="tabs"><div data-gb-custom-block data-tag="tab" data-title="Example" data-icon="glasses-round"><p>client_id=012345a6-abc1-012a-0ab1-01a23b45cd6789012</p></div></div></td></tr><tr><td>Role Claim Attribute</td><td><p>Attributes in the claims array from the access_token that define where DQ roles and user groups should be mapped.</p><div data-gb-custom-block data-tag="tabs"><div data-gb-custom-block data-tag="tab" data-title="Example" data-icon="glasses-round"><p>params,Groups</p></div></div></td></tr><tr><td>Scope</td><td><p>Optional. IdP-specific properties that define the scope of what is returned in the access_token from the OAuth or OIDC request.</p><div data-gb-custom-block data-tag="tabs"><div data-gb-custom-block data-tag="tab" data-title="Example" data-icon="glasses-round"><p>openid groups params profile</p></div></div></td></tr></tbody></table>
{% endstep %}

{% step %}
Click **Save**.
{% endstep %}
{% endstepper %}

### Available global configurations

{% tabs %}
{% tab title="Standalone" %}

<table><thead><tr><th width="152">owl-env.sh property</th><th>Description</th><th>Default value</th></tr></thead><tbody><tr><td><code>export SECURITY_OAUTH_USECLIENTAUTHORIZATIONHEADER=&#x3C;value></code></td><td>This is the useClientAuthorizationHeader IdP value. When set to <code>TRUE</code>, this configuration attempts to use clientID and clientSecret to build an authorization header for the IdP request.</td><td><code>FALSE</code></td></tr><tr><td><code>export SECURITY_OAUTH_CLIENTID=&#x3C;value></code></td><td>This is the clientID IdP value, which Data Quality &#x26; Observability (self-hosted) uses to build the authorization header when useClientAuthorizationHeader is enabled.</td><td>N/A</td></tr><tr><td><code>export SECURITY_OAUTH_CLIENTSECRET=&#x3C;value></code></td><td>This is the clientSecret IdP value, which Data Quality &#x26; Observability (self-hosted) uses to build the authorization header when useClientAuthorizationHeader is enabled.</td><td>N/A</td></tr><tr><td><code>export SECURITY_OAUTH_FALLBACK_ROLES_IDTOKEN=&#x3C;value></code></td><td>When set to <code>TRUE</code>, if the access_token fails, Data Quality &#x26; Observability (self-hosted) extracts the roles information from the id_token.</td><td><code>FALSE</code></td></tr></tbody></table>
{% endtab %}

{% tab title="Cloud Native" %}

<table><thead><tr><th width="152">Web ConfigMap property</th><th>Description</th><th>Default value</th></tr></thead><tbody><tr><td><code>SECURITY_OAUTH_USECLIENTAUTHORIZATIONHEADER: &#x3C;value></code></td><td>This is the useClientAuthorizationHeader IdP value. When set to <code>TRUE</code>, this configuration attempts to use clientID and clientSecret to build an authorization header for the IdP request.</td><td><code>FALSE</code></td></tr><tr><td><code>SECURITY_OAUTH_CLIENTID: &#x3C;value></code></td><td>This is the clientID IdP value, which Data Quality &#x26; Observability (self-hosted) uses to build the authorization header when useClientAuthorizationHeader is enabled.</td><td>N/A</td></tr><tr><td><code>SECURITY_OAUTH_CLIENTSECRET: &#x3C;value></code></td><td>This is the clientSecret IdP value, which Data Quality &#x26; Observability (self-hosted) uses to build the authorization header when useClientAuthorizationHeader is enabled.</td><td>N/A</td></tr><tr><td><code>SECURITY_OAUTH_FALLBACK_ROLES_IDTOKEN: &#x3C;value></code></td><td>When set to <code>TRUE</code>, if the access_token fails, Data Quality &#x26; Observability (self-hosted) extracts the roles information from the id_token.</td><td><code>FALSE</code></td></tr></tbody></table>
{% endtab %}
{% endtabs %}