Fix: Add Google Drive scope for BigQuery service account authentication #692
Conversation
|
Thanks for your pull request, and welcome to our community! We require contributors to sign our Contributor License Agreement and we don't seem to have your signature on file. Check out this article for more information on why we have a CLA. In order for us to review and merge your code, please submit the Individual Contributor License Agreement form attached above above. If you have questions about the CLA, or if you believe you've received this message in error, please reach out through a comment on this PR. CLA has not been signed by users: @timvyas |
|
Thank you for your pull request! We could not find a changelog entry for this change. For details on how to document a change, see the contributing guide. |
|
Thanks for your pull request, and welcome to our community! We require contributors to sign our Contributor License Agreement and we don't seem to have your signature on file. Check out this article for more information on why we have a CLA. In order for us to review and merge your code, please submit the Individual Contributor License Agreement form attached above above. If you have questions about the CLA, or if you believe you've received this message in error, please reach out through a comment on this PR. CLA has not been signed by users: @timvyas |
|
I have signed the CLA form. Please recheck. |
timvyas
force-pushed
the
fix/bigquery-service-account-google-sheets
branch
from
c71049a to
80d058f
Compare
|
This repository enforces signed commits. Please sign your commits by following the docs here. |
timvyas
force-pushed
the
fix/bigquery-service-account-google-sheets
branch
from
80d058f to
61705ff
Compare
This fix resolves the 'Permission denied while getting Drive credentials' error when using service accounts to access Google Sheets as external tables in BigQuery. Changes: - Add IMPERSONATE_SCOPES constant to dbt-xdbc/bigquery.rs - Configure Google Drive scope for both ServiceAccount and ServiceAccountJson authentication methods in dbt-auth/bigquery/mod.rs - Add OAuth scopes: bigquery, cloud-platform, and drive - Update unit tests to verify scopes are properly set This aligns dbt-fusion's service account authentication with dbt-core's implementation for Google Drive resource access through BigQuery.
CLA has been signed - triggering bot to recheck status
…dition - Rebase branch onto latest main to incorporate refactored BigQuery auth structure - Resolve merge conflicts from removal of TryFrom trait implementation - Add Google Drive scope to both config_service_account and config_service_account_json helper functions - Add test_service_account_keyfile_with_scopes to verify tilde expansion and scope addition - Update test_builder_from_auth_config_keyfile_json to verify scopes are included - Fix syntax error in test loop structure
timvyas
force-pushed
the
fix/bigquery-service-account-google-sheets
branch
from
61705ff to
4a91c57
Compare
1 participant
Summary
Resolves the "Permission denied while getting Drive credentials" error when using service accounts to access Google Sheets as external tables in BigQuery.
Problem Description
Service accounts in dbt-fusion cannot access Google Sheets as external tables, failing with:
This works fine with:
Root Cause
The BigQuery ADBC driver requires OAuth scopes to be explicitly set when using service accounts to access Google Drive resources. dbt-fusion was missing the
adbc.bigquery.sql.impersonate.scopesparameter configuration for service account authentication methods.Solution
Added Google Drive OAuth scope configuration to service account authentication:
Changes Made:
crates/dbt-xdbc/src/bigquery.rs: AddedIMPERSONATE_SCOPESconstant mapping to ADBC parametercrates/dbt-auth/src/bigquery/mod.rs: Configure scopes for bothServiceAccountandServiceAccountJsonmethodshttps://www.googleapis.com/auth/bigqueryhttps://www.googleapis.com/auth/cloud-platformhttps://www.googleapis.com/auth/drive← This was the missing scopeTesting
cargo build --releaserunandbuildcommands are not yet available in the open-source crates, so full integration testing with Google Sheets external tables cannot be performed from this repository. The fix can be verified once integrated into the complete dbt-fusion package.Compatibility
References
impersonate.scopesparameterChecklist
This change brings dbt-fusion's service account authentication in line with dbt-core's implementation for accessing Google Drive resources through BigQuery.