Snowflake¶

• A Snowflake account.
• External OAuth configured in Snowflake for Okta.

• A Snowflake account.
• External OAuth configured in Snowflake for Microsoft Azure AD.

Create a new App Integration in Okta:

1. Go to Applications > Applications.
2. Click Create App Integration.
3. For the Sign-in method, select OIDC - OpenID Connect.
4. For the Application type, select Web Application.
5. Click Next.

6. Make sure the following options are selected:

   • Client Credentials
   • Authorization Code
   • Refresh Token
   • Require consent

7. Under LOGIN, add http://localhost/account/snowflake/snowflake_authz_return to the Sign-in redirect URIs.

8. This results in your Client ID and Client secret.

Now, create a new Authorization Server:

1. Go to Security > API > Add Authorization Server.

   • Set Audience to https://<partner_name>.snowflakecomputing.com/. <partner_name> is the datarobot_partner for the current DataRobot Snowflake instance.

2. Go to Scopes > Add Scope.

   • Set Name to session:role:public (refers to the Snowflake role).
   • For Check-in, add Require user consent for this scope and Block services from requesting this scope.
   • (Optional) Set the offline_access scope to require consent.

3. Go to Access Policies > Add Rule and add the following rules:

   • Add Check-in Client Credentials.
   • Add Check-in Authorization Code.
   • Add the client integration (created above) to the Assigned to clients field.

4. Go to Token and click Create token.

5. This results in the following:

   • Issuer, for example, https://dev-11863425.okta.com/oauth2/aus15ca55wkdOxplJ5d7.
   • Auth Token for programmatic access to the Okta API.
   • Auth server metadata JSON (found in Settings > Metadata URI).

Okta API calls

curl --location --request GET 'https://<OKTA_ACCOUNT>.okta.com/api/v1/users/me' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: SSWS <TOKEN>'

curl --location --request GET 'https://<OKTA_ACCOUNT>.okta.com/api/v1/users/<USER_ID>/clients/<CLIENT_ID>/grants' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: SSWS <TOKEN>'

curl --location --request DELETE 'https://<OKTA_ACCOUNT>.okta.com/api/v1/users/<USER_ID>/grants/<GRANT_ID>' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: SSWS <TOKEN>'

Register an application for Snowflake Resource in Azure AD:

1. Go to MS Azure > Azure AD > App registrations.

2. Click New registration.

   • Under Name, enter Snowflake Resource.
   • Under Supported account types, select Accounts in this organizational directory only.
   • Under Redirect URI, select Web and enter http://localhost/account/snowflake/snowflake_authz_return.
   • Click Register.

3. Expose the API.

   • Set the Application ID URI to refer to the Snowflake URI (e.g., https://hl91180.us-east-2.aws.snowflakecomputing.com).
   • Add a scope to reference the existing Snowflake role; the scope is prefixed with the Application ID URI (e.g., https://hl91180.us-east-2.aws.snowflakecomputing.com/session:scope:public).

Register an application for Snowflake Client App in Azure AD:

1. Go to MS Azure > Azure AD > App registrations.

2. Click New registration.

   • Under Name, enter Snowflake Resource.
   • Under Supported account types, select Accounts in this organizationl directory only.
   • Under Redirect URI, select Web and enter http://localhost/account/snowflake/snowflake_authz_return.
   • Click Register.

3. Go to Client Credentials > New client secret and copy the value. Note that this value will not be available after this step.

4. Go to API Permission > Add Permission > My APIs > Snowflake Resource and choose the scope created above for Snowflake Resource (session:scope:public).

5. This results in the following:

   • Snowflake Client App: Client ID and Client secret

   • Issuer URL (<external_oauth_jws_keys_url> in Snowflake integration)

     • Go to Snowflake Client App > Overview > Endpoints > OpenID Connect metadata document, open the document in a browser, and search for jwks_uri (e.g., https://login.microsoftonline.com/6064c47c-80e4-4a2b-82ee-1fc5643b37a2/discovery/v2.0/keys).

   • Entity ID (<external_oauth_issuer> in Snowflake integration)

     • Go to Snowflake Client App > Overview > Endpoints > Federation metadata document, open the document in a browser, and search for entityID (e.g., https://sts.windows.net/6064c47c-80e4-4a2b-82ee-1fc5643b37a2/).

create security integration external_oauth_okta_2
    type = external_oauth
    enabled = true
    external_oauth_type = okta
    external_oauth_issuer = '<OKTA_ISSUER>'
    external_oauth_jws_keys_url = '<JWKS_URI>'
    external_oauth_audience_list = ('<AUDIENCE>')
    external_oauth_token_user_mapping_claim = 'sub'
    external_oauth_snowflake_user_mapping_attribute = 'login_name';

CREATE OR REPLACE USER <user_name>
  LOGIN_NAME = '<okta_user_name>';

alter user <user_name> set DEFAULT_ROLE = 'PUBLIC';

Reference values:

• OKTA_ISSUER: https://dev-11863425.okta.com/oauth2/aus15ca55wkdOxplJ5d7
• AUDIENCE: https://hl91180.us-east-2.aws.snowflakecomputing.com/
• JWKS_URI: https://dev-11863425.okta.com/oauth2/aus15ca55wkdOxplJ5d7/v1/keys (retrieved from Okta Auth server Metadata JSON)
• okta_user_name (retrieved from Okta > Directory > People, select a user, and then go to Profile > Username/login )