We have a Looker (original) instance to which we can log in with Entra ID. The same is true for GCP, and BigQuery in particular. We also have a working OAuth connection between Looker and BigQuery. However, when a user tries to use that connection, they are asked to log in with their Google account. So, their Entra ID session is not recognized, nor are they redirected to the IdP to create a new session for GCP. How can we have Looker users log in to BigQuery with their federated identities so that their actions are properly attributed in the GCP logs, and we can assign permissions to those identities?
I assume that Looker uses Google’s JDBC driver to access BigQuery. The installation and configuration guide states that it supports 5 authentication methods, among which “an external account (workload or workforce identity federation)”. Looker, however, seems to support only two of those options: Google service account, and Google user account (through OAuth).
Is there a way to enable login with an external identity? I have tried setting the relevant properties provided by the Simba connector (OAuthType, BYOID_PoolUserProject, BYOID_AudienceUri, BYOID_CredentialSource, BYOID_SubjectTokenType, and BYOID_TokenUri) in the Additional JDBC parameters setting of the connection, but Looker seems to ignore them entirely.