Connections > Google Cloud Storage V2 connection > Prerequisites for Workload Identity Federation (Client Credentials) authentication
  

Prerequisites for Workload Identity Federation (Client Credentials) authentication

Register Microsoft Entra ID as the identity provider and prepare Google Cloud before you configure WIF (Client Credentials) authentication.
To configure a Google Cloud Storage V2 connection for WIF (Client Credentials) authentication, complete the following tasks in order:
  1. 1Register an application in Microsoft Entra ID.
  2. 2Register Microsoft Entra ID with a Workload Identity Pool.
  3. 3Assign the required roles to the Workload Identity Pool principal.
  4. 4Enable uniform bucket-level access.
You use the tenant ID, client ID, client secret, project number, pool ID, and provider ID from these tasks to configure the connection.

Register an application in Microsoft Entra ID

Register an application in Microsoft Entra ID to get the client ID, client secret, and tenant ID that the connection uses.

Register the application and generate credentials

The connection uses the client ID, client secret, and tenant ID to request access tokens from Microsoft Entra ID.
Sign in to the Microsoft Entra admin center with an account that can register applications and create client secrets.
For more information about registering an application, see Microsoft app registration quickstart in the Microsoft documentation.
Note:
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
To register the application, perform the following steps:
  1. 1Go to Identity > Applications > App registrations, and click New registration.
  2. 2On the Register an application page, enter a name for the application in the Name field.
  3. 3In the Supported account types field, select Accounts in this organizational directory only (Single tenant).
  4. 4Click Register.
  5. 5On the application overview page, copy the Application (client) ID and Directory (tenant) ID values, and store them for later use.
  6. 6In the left pane, click Expose an API.
  7. 7Next to Application ID URI, click Set.
  8. 8In the Application ID URI field, enter the URI in the following format, and click Save:
    9. api://<client ID>
    Note:
    Microsoft Entra ID accepts an HTTPS URI only when the domain is verified for your tenant.
  9. 9In the left pane, click Certificates & secrets.
  10. 10On the Client secrets tab, click New client secret.
  11. 11Enter a description in the Description field, select an expiry period in the Expires field, and click Add.
    12. Note:
    Client secrets expire. Before the expiry date, create a new secret and update the connection.
  12. 12Copy the client secret from the Value column, not the Secret ID column, and store it securely.
    13. Note:
    Microsoft Entra ID displays the secret value only once. Rotate the client secret regularly.
You use the client ID, tenant ID, Application ID URI, and client secret to configure the connection and the Workload Identity Pool.

Assign the Contributor role on the Azure subscription

Assign the Contributor role to the registered application on the Azure subscription.
For more information about assigning Azure roles, see Assign Azure roles using the Azure portal in the Microsoft documentation.
Note:
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
To assign the role, perform the following steps:
  1. 1In the Azure portal, go to Subscriptions.
  2. 2Select the subscription where you plan to create resources for Google Cloud integration.
  3. 3Click Access control (IAM).
  4. 4Click Add role assignment.
  5. 5In the Role field, select Contributor.
  6. 6In the Assign access to field, select User, group, or service principal.
  7. 7In the Select members field, search for and select the name of the application that you registered.
  8. 8Click Save.

Register Microsoft Entra ID with a Workload Identity Pool

Create a Workload Identity Pool in Google Cloud, add Microsoft Entra ID as an OpenID Connect provider for the pool, and grant the registered application access to the pool.
For more information about creating a Workload Identity Pool and an OpenID Connect provider, see Workload Identity Federation with other providers in the Google Cloud documentation.
Note:
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
  1. 1In the Google Cloud console, go to IAM & Admin > Workload Identity Federation, and click Create Pool.
  2. 2Enter a name for the pool, and click Continue.
  3. 3Select OpenID Connect (OIDC) as the provider type, and click Continue.
  4. 4In the Issuer (URL) field, enter the Microsoft identity platform v2.0 token endpoint for the tenant in the following format:
    5. https://login.microsoftonline.com/<tenant ID>/v2.0
  5. 5In the Audiences field, enter the Application ID URI that you set for the application in Microsoft Entra ID, including the api:// prefix.
  6. 6Configure the attribute mapping so that google.subject maps to the subject claim of the Entra ID token, for example assertion.sub.
    7. Note:
    Use a value that uniquely identifies the application, such as the client ID.
  7. 7Click Save to create the provider.
  8. 8On the pool details page, click Grant Access, and select Grant access using the resource's IAM permissions.
  9. 9Enter the principal identifier for the application in the following format:
    10. principal://iam.googleapis.com/projects/<project number>/locations/global/workloadIdentityPools/<pool ID>/subject/<client ID>
  10. 10Record the pool ID and provider ID. You enter these values when you configure the Google Cloud Storage V2 connection.
    11. Note:
    Enter only the pool ID and provider ID, not the full resource path.

Assign required roles to the Workload Identity Pool principal

Grant the IAM roles that the Workload Identity Pool principal and the target service account require to access Google Cloud Storage.
Grant the roles in the following steps to the Workload Identity Pool principal and, when you enable service account impersonation, to the target service account.
For more information about granting IAM roles to a principal, see Granting, changing, and revoking access to resources in the Google Cloud documentation.
Note:
The third-party information included in Informatica documentation is subject to change without prior notice. Check the third-party documentation for the most up-to-date information.
  1. 1In the Google Cloud console, go to IAM & Admin > IAM for the project that contains the Workload Identity Pool.
  2. 2Click Grant Access, and add the Workload Identity Pool principal.
  3. 3In the Role field, select Workload Identity User, and click Save.
  4. 4If you enable service account impersonation, go to IAM & Admin > IAM for the project that contains the target service account.
  5. 5Click Grant Access, and add the Workload Identity Pool principal.
  6. 6In the Role field, select Service Account Token Creator, and click Save.
    7. Note:
    If you enable service account impersonation and omit this role, the connection fails with an authentication error.
  7. 7Grant the Storage Object Admin role on the Google Cloud Storage buckets that your mappings read from or write to. Grant the role to the Workload Identity Pool principal, or to the target service account if you enable service account impersonation.
  8. 8If you clear the Use Data Project property, grant the Workload Identity Pool principal the resourcemanager.projects.get permission on the project that contains the Workload Identity Pool.

Enable uniform bucket-level access

Enable uniform bucket-level access on the Google Cloud Storage buckets that the connection reads from and writes to.
For more information about uniform bucket-level access, see Uniform bucket-level access in the Google Cloud documentation.

Network access requirements

The Secure Agent machine requires outbound HTTPS access to the following endpoints for WIF (Client Credentials) authentication.
The following table lists the endpoints:
Endpoint
Purpose
login.microsoftonline.com
Request a token from Microsoft Entra ID.
sts.googleapis.com
Exchange the Microsoft Entra ID token for a federated Google access token.
iamcredentials.googleapis.com
Generate a short-lived access token for the target service account when you enable service account impersonation.
storage.googleapis.com
Read data from and write data to Google Cloud Storage buckets.
cloudresourcemanager.googleapis.com
Resolve the project for the Workload Identity Pool when you clear the Use Data Project property.