feat(go/adbc/driver/bigquery): add external-account (WIF) auth#134
feat(go/adbc/driver/bigquery): add external-account (WIF) auth#134ragesh-g wants to merge 1 commit into
Conversation
ragesh-g
force-pushed
the
ragesh/bq-support-wif
branch
7 times, most recently
from
76ffbc3 to
c5f5dbf
Compare
ragesh-g
force-pushed
the
ragesh/bq-support-wif
branch
from
c5f5dbf to
a39cd55
Compare
| req.Header.Set("Accept", "application/json") | ||
| req.Header.Set("Content-Type", "application/x-www-form-urlencoded") | ||
|
|
||
| resp, err := idpHTTPClient.Do(req) |
There was a problem hiding this comment.
I generally agree the network call should be at this layer. I think we should do exponential backoff with jitter here. Make constants at top of the file. start at 500ms, tiny bit of jitter to prevent collisions. This keeps it at 15ish seconds worst case for a total failure, which is well within the 30s timeout already on the HTTP client. Don't expose the retries upstream
| } | ||
|
|
||
| var tokenResponse bigQueryTokenResponse | ||
| if err := json.Unmarshal(body, &tokenResponse); err != nil { |
There was a problem hiding this comment.
anyway we can map the error to something more human readable? Ask claude, I -think- there are some cases we'd like to be more sophisticated in catching the errors since this might show up in fs as something like "cannot unmarshal into json" and users would have no idea what's going on
VersusFacit
left a comment
VersusFacit
left a comment
There was a problem hiding this comment.
Request for retry logic, but this is pretty much good to go
2 participants
Summary
This adds Workload Identity Federation (WIF) as an authentication option for the BigQuery driver. With WIF, a workload authenticates through an external identity provider (Microsoft Entra, in the dbt setup) and Google grants BigQuery access based on that.
How it works
When a profile uses this method, the driver:
then uses the resulting token to run BigQuery jobs.
It reads four new settings from the profile: the workload pool/provider path, the provider's token URL, the request body to send it, and an optional service-account impersonation URL.
Testing
dbt runagainst BigQuery via Entra WIF, driven through dbt-labs/fs#10486.Dependency
Paired with dbt-labs/fs#10486 (the dbt side that sets these options).