Federated authentication experiment

Gemfile

@@ -65,6 +65,8 @@ gem 'dfe-reference-data', require: 'dfe/reference_data', github: 'DFE-Digital/df
 
 gem "rolify"
 
+gem "google-cloud-bigquery", "1.50.0"
+
 gem 'phonelib'
 gem 'sentry-rails'
 gem 'sentry-ruby'

Gemfile.lock

@@ -277,29 +277,31 @@ GEM
     geocoder (1.8.2)
     globalid (1.2.1)
       activesupport (>= 6.1)
-    google-apis-bigquery_v2 (0.62.0)
-      google-apis-core (>= 0.12.0, < 2.a)
-    google-apis-core (0.12.0)
+    google-apis-bigquery_v2 (0.80.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-core (0.15.1)
       addressable (~> 2.5, >= 2.5.1)
       googleauth (~> 1.9)
-      httpclient (>= 2.8.1, < 3.a)
+      httpclient (>= 2.8.3, < 3.a)
       mini_mime (~> 1.0)
+      mutex_m
       representable (~> 3.0)
       retriable (>= 2.0, < 4.a)
-      rexml
-    google-cloud-bigquery (1.45.0)
+    google-cloud-bigquery (1.50.0)
+      bigdecimal (~> 3.0)
       concurrent-ruby (~> 1.0)
-      google-apis-bigquery_v2 (~> 0.1)
+      google-apis-bigquery_v2 (~> 0.71)
+      google-apis-core (~> 0.13)
       google-cloud-core (~> 1.6)
-      googleauth (>= 0.16.2, < 2.a)
+      googleauth (~> 1.9)
       mini_mime (~> 1.0)
-    google-cloud-core (1.6.1)
+    google-cloud-core (1.7.1)
       google-cloud-env (>= 1.0, < 3.a)
       google-cloud-errors (~> 1.0)
-    google-cloud-env (2.1.0)
+    google-cloud-env (2.2.1)
       faraday (>= 1.0, < 3.a)
-    google-cloud-errors (1.3.1)
-    googleauth (1.9.1)
+    google-cloud-errors (1.4.0)
+    googleauth (1.11.2)
       faraday (>= 1.0, < 3.a)
       google-cloud-env (~> 2.1)
       jwt (>= 1.4, < 3.0)
@@ -377,6 +379,7 @@ GEM
     multi_test (1.1.0)
     multi_xml (0.6.0)
     multipart-post (2.4.1)
+    mutex_m (0.2.0)
     net-imap (0.4.10)
       date
       net-protocol
@@ -752,6 +755,7 @@ DEPENDENCIES
   foreman
   geocoder
   get_into_teaching_api_client_faraday (= 3.4.0)!
+  google-cloud-bigquery (= 1.50.0)
   govuk_design_system_formbuilder (~> 4.0.0)
   hashids
   ice_cube

config/initializers/dfe_analytics.rb

@@ -1,11 +1,13 @@
 DfE::Analytics.configure do |config|
+  config.azure_federated_auth = true
+
   # Whether to log events instead of sending them to BigQuery.
   #
   config.log_only = false
 
   # Whether to use ActiveJob or dispatch events immediately.
   #
-  config.async = true
+  config.async = false
   config.entity_table_checks_enabled = true
 
   # Which ActiveJob queue to put events on
@@ -53,4 +55,34 @@
   # config.environment = ENV.fetch('RAILS_ENV', 'development')
 
   config.bigquery_maintenance_window = "08-09-2024 18:00..08-09-2024 19:00"
+
+  # The name of the BigQuery table we’re writing to.
+  #
+  config.bigquery_table_name = 'events'
+
+  # The name of the BigQuery project we’re writing to.
+  #
+  config.bigquery_project_id = 'get-into-teaching'
+
+  # The name of the BigQuery dataset we're writing to.
+  #
+  config.bigquery_dataset = 'bat_cross_project'
+
+  # Ensure JSON API Key does not get set
+  config.bigquery_api_json_key = ''
+
+  config.google_cloud_credentials = {
+    universe_domain: "googleapis.com",
+    type: "external_account",
+    audience: "//iam.googleapis.com/projects/574582782335/locations/global/workloadIdentityPools/azure-cip-identity-pool/providers/azure-cip-oidc-provider",
+    subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
+    token_url: "https://sts.googleapis.com/v1/token",
+    credential_source: {
+      url: "https://login.microsoftonline.com/9c7d9dd3-840c-4b3f-818e-552865082e16/oauth2/v2.0/token"
+    },
+    service_account_impersonation_url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken",
+    service_account_impersonation: {
+      token_lifetime_seconds: 3600
+    }
+  }
 end