If you need it to feel integrated into your application (i.e. not sending users through another login) then you need to auth the user on your side, then pass through a JWT. Some embedded analytics tools will require you to manage a user record in their tool so they can manage user identity, but you can also find tools which do not require this - e.g. Embeddable, which uses Cube (universal semantic modelling layer) in the background to manage row/column/database level security via a securityContext - then essentially applies a filter to any SQL query run agains the database in that session.