Prerequisites for Workload Identity Federation authentication

Prerequisites for Workload Identity Federation (Authorization Code) authentication

• •Project number
• •Client ID
• •Secret ID
• •Authorization URL
• •Access token URL
• •Pool ID
• •Provider ID
• •Access token

Set up an OAuth application in the Okta server

1. 1Log in to the Okta portal as an Okta administrator.
2. 2From the Admin console, go to Applications.
3. 3Click Create App Integration.
4. 4On the Create a new app integration page, perform the following steps:
1. aIn the Sign-in method, select OIDC - OpenID Connect.
2. bIn the Application type, select Web Application and click Next.
5. 5On the New Web App Integration page, perform the following steps:
1. aEnter the OAuth application name in the App integration name field.
Example: Informatica Cloud Okta OIDC Web Application
2. bSelect Authorization Code and Refresh Token in the Grant type field.
3. cEnter the URIs in the Sign-in redirect URIs and Sign-out redirect URIs fields. You can enter multiple URIs.
Syntax: https://<Server name where Informatica Secure Agent is hosted>/ma/proxy/oauthcallback
4. dIn the Refresh Token section, select Use persistent token in the Refresh token behavior field.
5. eIn the USER CONSENT section, select Require consent in the User consent field.
6. fIn the Assignments section, perform the following steps:
1. aSelect an option in the Controlled access field.
2. bSelect Enable immediate access with Federation Broker Mode in the Enable immediate access field.
7. gClick Save. Okta creates the OAuth application.
6Record the values of the Client ID and CLIENT SECRET fields. You require these values to configure the Google BigQuery V2 connection.

Add an Okta authorization server

1. 1Log in to the Okta portal as an Okta administrator.
2. 2Go to Security > API.
3. 3On the Authorization Servers tab, click Add Authorization Server.
4. 4On the Add Authorization Server page, perform the following steps:
1. aEnter a name for the authorization server in the Name field.
Example: Informatica Cloud Okta Authorization Server
2. bEnter the value in the Audience field.
Syntax: gcp-workload-identity-pool://<Workload Identity Pool ID>
Note:
Ensure that you enter the same value in the identity provider field in Google Cloud console.
3. cEnter the description in the Description field and click Save.
4. dRecord the Okta issuer value, which is required for the server configuration.
5. 5On the Settings tab, perform the following steps:
1. aClick Metadata URI. A JSON response output is generated.
Note:
Alternatively, you can copy the value and open it in a browser window.
2. bCopy the JSON response output to an advanced text editor application and record the values of the following parameters:
• ▪ authorization_endpoint: This value specifies the Okta authorization server issuer URI. Enter this value in the Authorization URL field of the Google BigQuery V2 connection.
• ▪ token_endpoint: This value specifies the Okta authorization server access token endpoint. Enter this value in the Access Token URL field of the Google BigQuery V2 connection.
• ▪ jwks_uri: This value specifies the Okta authorization server JSON web key sets URI.

6. 6On the Claims tab, verify that an Access type exists with the name sub.
7. 7On the Access Policies tab, click Add New Access Policy.
8. 8On the Add Policy page, perform the following steps:
1. aEnter the policy name in the Name field.
Example: Informatica Cloud Access Policy v1
2. bEnter the policy description in the Description field.
3. cSelect the The following clients: option in the Assign to field and select the OIDC web application that you created.
Note:
You can select multiple client applications.
4. dClick Create Policy.
9. 9On the Access Policies tab, click Add Rule in the newly created access policy.
10. 10On the Add Rule page, perform the following steps:
1. aEnter the rule name in the Rule Name field.
2. bIn the IF Grant type is field, perform the following steps:
1. aSelect Client Credentials in the Client acting on behalf of itself field.
2. bSelect Authorization Code in the Core grants field.
3. cSelect Implicit (hybrid) and Resource Owner Password in the Other grants field.
3. cIn the AND User is field, select Any user assigned the app.
Note:
You can further review the access policy rules and specify restrictions for additional groups or users.
4. dIn the AND Scopes requested field, select Any scopes.
5. eVerify the default value set for the AND Access token lifetime is field and adjust the value, if required.
6. fClick Create rule.
11. 11On the Token Preview tab, perform the following steps to verify the configuration for the Okta authorization server:
1. aIn the Request Properties section, perform the following steps:
1. aSelect the Okta OIDC web application that you created in the OAuth/OIDC client field.
2. bSelect Authorization Code in the Grant type field.
3. cSelect a user in the User field.
Note:
Ensure that the selected user is a member of any of the groups associated with the OIDC web application that you created and the access policy rule set for the authorization server.
4. dEnter openid in the Scopes field.
5. eClick Preview Token.
2. bIn the Preview section, go to the token tab.
3. cIn the Payload section, verify the value of the sub claim or any other claims that you created.

Register the identity provider with Workload Identity Pool

1. 1In the Google Cloud console, go to IAM & Admin > Workload Identity Federation.
2. 2Click Create pool.
3. 3In the Create an identity pool section, perform the following steps:
1. aEnter the identity pool name in the Name field.
2. bEnter the identity pool ID in the Pool ID field.
3. cEnter the identity pool description in the Description field.
4. dClick Continue.
4. 4In the Add a provider to pool section, select OpenID Connect (OIDC) in the Select a provider field.
5. 5In the Configure provider attributes section, perform the following steps:
1. aEnter the identity provider name in the Provider name field.
2. bEnter the identity provider issuer URL in the Issuer (URL) field.
3. cEnsure that the JWK file (JSON) field is empty.
4. dSelect the Allowed audiences option.
5. eEnter gcp-workload-identity-pool://<identity pool ID> in the Audience 1 field.
6. fClick Continue.
7. gVerify that google.subject is populated automatically in the Google 1 field.
8. hEnter assertion.sub in the OIDC 1 field.
9. iClick Save.
6. 6iRecord the values of Pool ID and Provider ID that you created. You require these values to configure the Google BigQuery V2 connection.

Assign required roles to Workload Identity Pool principal user

1. 1In the Google Cloud console, go to IAM & Admin > IAM > Allow.
2. 2Click Grant Access.
3. 3On the Grant access to "API Project" page, perform the following steps:
1. aEnter the IAM principal information in the New principals field.
Syntax: principal://iam.googleapis.com/projects/<Project number>/locations/global/workloadIdentityPools/<Pool ID>/subject/<email ID of the registered user>
You can find the project number in the Google Cloud console. You require this value to configure the Google BigQuery V2 connection.
2. bAssign the required roles for the IAM principal user.
Note:
You can assign multiple roles for the user. For a beginner user, you can assign roles such as BigQuery Admin, Storage Admin, and Workload Identity User.
4. 4Click Save.

Prerequisites for Workload Identity Federation (Client Credentials) authentication

1. 1Review the network access requirements.
2. 2Register an application in Microsoft Entra ID.
3. 3Assign the Contributor role on the Azure subscription.
4. 4Register Microsoft Entra ID with a Workload Identity Pool.
5. 5Assign the required roles to the Workload Identity Pool principal.
6. 6Enable uniform bucket-level access.

• •Tenant ID
• •Client ID
• •Client secret
• •Application ID URI
• •Project number
• •Pool ID
• •Provider ID

Network access requirements

Register an application in Microsoft Entra ID

1. 1Go to Entra ID > App registrations, and click New registration.
2. 2On the Register an application page, enter a name for the application in the Name field.
3. 3In the Supported account types field, select Single tenant only - <your tenant>.
4. 4Click Register.
5. 5On the application overview page, copy the Application (client) ID and Directory (tenant) ID values, and store them for later use.
6. 6In the left pane, click Expose an API.
7. 7Next to Application ID URI, click Set.
8. 8In the Application ID URI field, enter the URI in the following format, and click Save:
Syntax: api://<client ID>
Microsoft Entra ID accepts an HTTPS URI only for a domain that you verify in your tenant.
9. 9In the left pane, click Certificates & secrets.
10. 10On the Client secrets tab, click New client secret.
11. 11Enter a description in the Description field, select an expiry period in the Expires field, and click Add.
12. 12Copy the client secret from the Value column, and store it securely. Don't copy the value in the Secret ID column.
Microsoft Entra ID displays the secret value only once.
13. 13Record the values of the client ID, tenant ID, Application ID URI, and client secret. You require these values to configure the Google BigQuery V2 connection and the Workload Identity Pool.

Assign the Contributor role on the Azure subscription

1. 1In the Azure portal, go to Subscriptions.
2. 2Select the subscription where you plan to create resources for Google Cloud integration.
3. 3Click Access control (IAM).
4. 4Click Add role assignment.
5. 5In the Role field, select Contributor.
6. 6In the Assign access to field, select User, group, or service principal.
7. 7In the Select members field, search for and select the application name you registered.
8. 8Click Save.

Register Microsoft Entra ID with a Workload Identity Pool

1. 1In the Google Cloud console, go to IAM & Admin > Workload Identity Federation, and click Create Pool.
2. 2Enter a name for the pool, and click Continue.
3. 3Select OpenID Connect (OIDC) as the provider type, and click Continue.
4. 4In the Issuer (URL) field, enter the Microsoft identity platform v2.0 token endpoint for the tenant in the following format:
Syntax: https://login.microsoftonline.com/<tenant ID>/v2.0
5. 5In the Audiences field, enter the Application ID URI that you set for the application in Microsoft Entra ID.
Enter the value exactly as it appears in Microsoft Entra ID, including the api:// prefix.
6. 6Configure the attribute mapping so that google.subject maps to the subject claim of the Entra ID token, for example assertion.sub.
Ensure that google.subject resolves to a value that uniquely identifies the application, such as the client ID.
7. 7Click Save to create the provider.
8. 8On the pool details page, click Grant Access, and select Grant access using the resource's IAM permissions.
9. 9Enter the principal identifier for the application in the following format:
Syntax: principal://iam.googleapis.com/projects/<project number>/locations/global/workloadIdentityPools/<pool ID>/subject/<client ID>
10. 10Record the full resource paths of the pool and provider, not the short IDs. You require these values to configure the Google BigQuery V2 connection.
Pool ID syntax: projects/<project number>/locations/global/workloadIdentityPools/<pool ID>
Provider ID syntax: projects/<project number>/locations/global/workloadIdentityPools/<pool ID>/providers/<provider ID>

Assign required roles to the workload identity pool principal

1. 1In the Google Cloud console, go to IAM & Admin > IAM for the project that contains the workload identity pool.
2. 2Click Grant Access, and add the pool principal as a new principal.
3. 3In the Role field, assign the following roles:
• - Workload Identity User
• - Roles that provide read and write access to BigQuery
• - Roles that provide read and write access to Google Cloud Storage
4. 4Click Save.
5. 5If you enable service account impersonation, go to IAM & Admin > IAM for the project that contains the target service account.
6. 6Click Grant Access, and add the workload identity pool principal as a new principal.
7. 7In the Role field, select Service Account Token Creator, and click Save.
8. 8Grant the target service account the BigQuery roles that your mappings require, such as BigQuery Data Editor and BigQuery Job User, in the project where the BigQuery datasets reside.

Enable uniform bucket-level access