Prerequisites for Workload Identity Federation (Client Credentials) authentication
Before you configure a Google BigQuery V2 connection to use Workload Identity Federation (Client Credentials) authentication, you need to register Microsoft Entra ID as the identity provider, and then complete the following tasks in order:
1Register an application in Microsoft Entra ID.
2Register Microsoft Entra ID with a Workload Identity Pool.
3Assign the required roles to the Workload Identity Pool principal.
After you complete these tasks, you have the tenant ID, client ID, client secret, project number, pool ID, and provider ID that you use to configure the connection.
Note:
Data Ingestion and Replication can't use the Workload Identity Federation (Client Credentials) authentication.
Network access requirements
The Secure Agent machine requires outbound HTTPS access to the following endpoints:
Endpoint
Purpose
login.microsoftonline.com
Request an OpenID Connect (OIDC) token from Microsoft Entra ID.
sts.googleapis.com
Exchange the Entra ID token for a federated Google access token.
iamcredentials.googleapis.com
Generate a short-lived access token for the target service account when you enable service account impersonation.
bigquery.googleapis.com
Run BigQuery jobs and queries.
storage.googleapis.com
Stage data in Google Cloud Storage buckets.
cloudresourcemanager.googleapis.com
Look up the data project when you clear the Use Data Project property and the connection resolves the project associated with the workload identity pool.
Register an application in Microsoft Entra ID
Register the application and generate credentials
Register an application in Microsoft Entra ID to get the client ID, client secret, and tenant ID. The connection uses these values to request access tokens.
Sign in to the Microsoft Entra admin center with an account that has permissions to register applications and create client secrets.
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
1Go to Identity > Applications > App registrations, and click New registration.
2On the Register an application page, enter a name for the application in the Name field.
3In the Supported account types field, select Accounts in this organizational directory only (Single tenant).
4Click Register.
5On the application overview page, copy the Application (client) ID and Directory (tenant) ID values, and store them for later use.
6In the left pane, click Expose an API.
7Next to Application ID URI, click Set.
8In the Application ID URI field, enter the URI in the following format, and click Save:
Syntax: api://<client ID>
9In the left pane, click Certificates & secrets.
10On the Client secrets tab, click New client secret.
11Enter a description in the Description field, select an expiry period in the Expires field, and click Add.
12Copy the client secret from the Value column, and store it securely. Do not copy the value in the Secret ID column.
Microsoft Entra ID displays the secret value only once.
Record the values of the client ID, tenant ID, Application ID URI, and client secret. You require these values to configure the Google BigQuery V2 connection and the Workload Identity Pool.
Assign the Contributor role on the Azure subscription
Assign the Contributor role to the registered application on the Azure subscription.
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
1In the Azure portal, go to Subscriptions.
2Select the subscription where you plan to create resources for Google Cloud integration.
3Click Access control (IAM).
4Click Add role assignment.
5In the Role field, select Contributor.
6In the Assign access to field, select User, group, or service principal.
7In the Select members field, search for and select the application name you registered.
8Click Save.
Rules and guidelines
Consider the following rules and guidelines:
•Use the api://<client ID> format for the Application ID URI. Microsoft Entra ID accepts an HTTPS URI only when the domain is verified for your tenant.
•Client secrets expire. Before the expiry date, create a new secret and update the connection.
•Store the client secret in a secure location, and rotate it regularly.
Register Microsoft Entra ID with a Workload Identity Pool
Create the Workload Identity Pool, add a provider, and grant access
Create a Workload Identity Pool in Google Cloud, add Microsoft Entra ID as an OpenID Connect provider for the pool, and grant the registered application access to the pool.
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
1In the Google Cloud console, go to IAM & Admin > Workload Identity Federation, and click Create Pool.
2Enter a name for the pool, and click Continue.
3Select OpenID Connect (OIDC) as the provider type, and click Continue.
4In the Issuer (URL) field, enter the Microsoft identity platform v2.0 token endpoint for the tenant in the following format:
10Record the full resource paths of the pool and provider. You require these values to configure the Google BigQuery V2 connection.
Pool ID syntax: projects/<project number>/locations/global/workloadIdentityPools/<pool ID>
Provider ID syntax: projects/<project number>/locations/global/workloadIdentityPools/<pool ID>/providers/<provider ID>
Rules and guidelines
Consider the following rules and guidelines:
•Use the full resource path for the pool ID and provider ID, not the short ID, when you configure the connection.
•The Audiences value must match the Application ID URI exactly, including the api:// prefix.
•The attribute mapping needs to resolve google.subject to a value that uniquely identifies the application, such as the client ID.
Assign required roles to the workload identity pool principal
Grant the required IAM roles
Grant the workload identity pool principal the Workload Identity User role, and, if you enable service account impersonation, grant the pool principal the Service Account Token Creator role on the target service account.
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
1In the Google Cloud console, go to IAM & Admin > IAM for the project that contains the workload identity pool.
2Click Grant Access, and add the pool principal as a new principal.
3In the Role field, select Workload Identity User, and click Save.
4If you enable service account impersonation, go to IAM & Admin > IAM for the project that contains the target service account.
5Click Grant Access, and add the workload identity pool principal as a new principal.
6In the Role field, select Service Account Token Creator, and click Save.
7Grant the target service account the BigQuery roles that your mappings require, such as BigQuery Data Editor and BigQuery Job User, in the project where the BigQuery datasets reside.
Rules and guidelines
Consider the following rules and guidelines:
•You don't need to grant storage roles directly to the workload identity pool principal.
•Grant the Service Account Token Creator role only when you enable service account impersonation. Without this role, the connection fails with an authentication error.
•Grant each role in the project where the corresponding resource resides: Workload Identity User in the pool's project, and Service Account Token Creator and BigQuery roles in the project that contains the target service account and data.
Enable uniform bucket-level access
Enable uniform bucket-level access on the Google Cloud Storage buckets that the connection reads from and writes to, and on the staging buckets that Google BigQuery V2 uses.