# Workload identity federation examples #

Workload identity federation for the Google BigQuery connection is supported by any identity provider that supports OpenID Connect (OIDC) or SAML 2\.0\.

These examples are for [AWS with Amazon Cognito](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/wif-examples.html?context=cdpaas&locale=en#aws) and for [Microsoft Azure](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/wif-examples.html?context=cdpaas&locale=en#azure)\.

## AWS ##

### Configure workload identity federation in Amazon Cognito ###

<!-- <ol> -->

1.  Create an OIDC identity provider (IdP) with Cognito by following the instructions in the Amazon documentation:
    
    <!-- <ul> -->
    
     *  [Step 1. Create a user pool](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-as-user-directory.html)
     *  [Step 2. Add an app client and set up the hosted UI](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-configuring-app-integration.html)
    
    <!-- </ul> -->
    
    For more information, see [Getting started with Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-getting-started.html).
2.  Create a group and user in the IdP with the AWS console\. Or you can use AWS CLI:
    
        CLIENT_ID=YourClientId
        ISSUER_URL=https://cognito-idp.YourRegion.amazonaws.com/YourPoolId
        POOL_ID=YourPoolId
        USERNAME=YourUsername
        PASSWORD=YourPassword
        GROUPNAME=YourGroupName
        
        aws cognito-idp admin-create-user --user-pool-id $POOL_ID --username $USERNAME --temporary-password Temp-Pass1
        aws cognito-idp admin-set-user-password --user-pool-id $POOL_ID --username $USERNAME --password $PASSWORD --permanent
        aws cognito-idp create-group --group-name $GROUPNAME --user-pool-id $POOL_ID
        aws cognito-idp admin-add-user-to-group --user-pool-id $POOL_ID --username $USERNAME --group-name $GROUPNAME
3.  From the AWS console, click **View Hosted UI** and log in to the IDP UI in a browser to ensure that any new password challenge is resolved\.
4.  Get an IdToken with the AWS CLI:
    
        aws cognito-idp admin-initiate-auth --auth-flow ADMIN_USER_PASSWORD_AUTH --client-id $CLIENT_ID --auth-parameters USERNAME=$USERNAME,PASSWORD=$PASSWORD --user-pool-id $POOL_ID
    
    For more information on the Amazon Cognito User Pools authentication flow, see [AdminInitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html).

<!-- </ol> -->

### Configure Google Cloud for Amazon Cognito ###

When you create the provider in Google Cloud, use these settings:

<!-- <ul> -->

 *  Set **Issuer (URL)** to `https://cognito-idp.YourRegion.amazonaws.com/YourPoolId`\.
 *  Set **Allowed Audience** to your client ID\.
 *  Under **Attribute Mapping**, map `google.subject` to `assertion.sub`\.

<!-- </ul> -->

### Create the Google BigQuery connection with Amazon Cognito workload identity federation ###

<!-- <ol> -->

1.  Choose the **Workload Identity Federation with access token** authentication method\.
2.  For the **Security Token Service audience** field, use this format:
    
        //iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID
3.  For the **Service account e\-mail**, enter the email address of the Google service account to be impersonated\. For more information, see [Create a service account for the external workload](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#create_a_service_account_for_the_external_workload)\.
4.  (Optional) Specify a value for the **Service account token lifetime** in seconds\. The default lifetime of a service account access token is one hour\. For more information, see [URL\-sourced credentials](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#url-sourced-credentials)\.
5.  Set **Token format** to `Text`
6.  Set **Token type** to `ID token`

<!-- </ol> -->

## Azure ##

### Configure workload identity federation in Azure ###

<!-- <ol> -->

1.  [Create an Azure AD application and service principal](https://learn.microsoft.com/en-au/azure/active-directory/develop/howto-create-service-principal-portal#register-an-application-with-azure-ad-and-create-a-service-principal)\.
2.  Set an **Application ID URI** for the application\. You can use the default Application ID URI (`api://APPID`) or specify a custom URI\.  
      
    You can skip the instructions on creating a managed identity.
3.  Follow the instructions to [create a new application secret](https://learn.microsoft.com/en-au/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret) to get an access token with the REST API\.
    
    For more information, see [Configure workload identity federation with Azure](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#azure).

<!-- </ol> -->

### Configure Google Cloud for Azure ###

<!-- <ol> -->

1.  Follow the instructions: [Configure workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#configure)\.
2.  Follow the instructions: [Create the workload identity pool and provider](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#create_the_workload_identity_pool_and_provider)\. When you configure the provider, use these settings:
    
    <!-- <ul> -->
    
     *  Set **Issuer (URL)** to `https://sts.windows.net/TENANTID/`, where `TENANTID` is the tenant ID that you received when you set up Azure Active Directory.
     *  Set the **Allowed audience** to the client ID that you received when you set up the app registration. Or specify another **Application ID URI** that you used when you set up the application identity in Azure.
     *  Under **Attribute Mapping**, map `google.subject` to `assertion.sub`.
    
    <!-- </ul> -->
    
<!-- </ol> -->

### Create the Google BigQuery connection with Azure workload identity federation ###

<!-- <ol> -->

1.  Choose one of these authentication methods:
    
    <!-- <ul> -->
    
     *  **Workload Identity Federation with access token**
     *  **Workload Identity Federation with token URL**
    
    <!-- </ul> -->
    
2.  For the **Security Token Service audience** field, use the format that is described in [Authenticate a workload that uses the REST API](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#azure_7)\. For example:
    
        //iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID
3.  For the **Service account e\-mail**, enter the email address of the Google service account to be impersonated\. For more information, see [Create a service account for the external workload](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#create_a_service_account_for_the_external_workload)\.
4.  (Optional) Specify a value for the **Service account token lifetime** in seconds\. The default lifetime of a service account access token is one hour\. For more information, see [URL\-sourced credentials](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#url-sourced-credentials)\.
5.  If you specified **Workload Identity Federation with token URL**, use these values:
    
    <!-- <ul> -->
    
     *  **Token URL**: `https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token`. This URL will fetch a token from Azure.
     *  **HTTP method**: `POST`
     *  **HTTP headers**: `"Content-Type"="application/x-www-form-urlencoded;charset=UTF-8","Accept"="application/json"`
     *  **Request body**: `grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&scope=APPLICATION_ID_URI/.default`
    
    <!-- </ul> -->
    
6.  For **Token type**, select **ID token** for an identity provider that complies with the OpenID Connect (OIDC) specification\. For information, see [Token types](https://cloud.google.com/docs/authentication/token-types)\.
7.  The **Token format** option depends on that authentication selection:
    
    <!-- <ul> -->
    
     *  **Workload Identity Federation with access token**: Select **Text** if you supplied the raw token value in the **Access token** field.
     *  **Workload Identity Federation with token URL**: For a response from the token URL in JSON format with the access token that is returned in a field named `access_token`, use these settings:
        
        <!-- <ul> -->
        
         *  **Token format**: `JSON`
         *  **Token field name**: `access_token`
        
        <!-- </ul> -->
        
    <!-- </ul> -->
    
<!-- </ol> -->

## Learn more ##

<!-- <ul> -->

 *  [Workload identity federation (Google Cloud)](https://cloud.google.com/iam/docs/workload-identity-federation)
 *  [Configure workload identity federation on the identity provider (Google Cloud)](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds)
 *  [Generate a credentials configuration file (Google Cloud)](https://github.com/googleapis/google-auth-library-java#workforce-identity-federation)

<!-- </ul> -->

**Parent topic:**[Google BigQuery connection](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/conn-bigquery.html)

<!-- </article "role="article" "> -->