Snowflake¶

When creating a Snowflake data connection in DataRobot Classic, select Key-pair as your credential type. Then, fill in the required parameters.

When creating a Snowflake data connection in Workbench, select Key-pair as your credential type. Then, fill in the required parameters.

• A Snowflake account.
• External OAuth configured in Snowflake for Okta.

Microsoft Entra ID is the new name for Azure Active Directory.

• A Snowflake account.
• External OAuth configured in Snowflake for Microsoft Entra ID.

Create a new App Integration in Okta:

1. Go to Applications > Applications.
2. Click Create App Integration.
3. For the Sign-in method, select OIDC - OpenID Connect.
4. For the Application type, select Web Application.
5. Click Next.
6. Enter a name for the new application.

7. Under Grant type, make sure the following options are selected:

   • Client Credentials
   • Authorization Code
   • Refresh Token

8. Under LOGIN, add http://<datarobot_app_server>/account/snowflake/snowflake_authz_return to the Sign-in redirect URIs.

9. Click Save—this generates your Client ID and Client secret.

Create a new Authorization Server:

1. Go to Security > API > Authorization Server. Click Add Authorization Server.
2. Enter a name.
3. Set Audience to https://<account_identifier>.snowflakecomputing.com/.
4. Click Save.

5. Go to Scopes > Add Scope.

   • Set Name to session:role:public. public refers to the Snowflake role called Public. This can be a different role name, but it must also exist within Snowflake.
   • For User Consent, set Required.
   • Add Require user consent for this scope and Block services from requesting this scope.
   • (Optional) Set the offline_access scope to require consent.

6. Go to Access Policies and click Add Policy.

7. For Assign to, select The following clients and select the application you just created.
8. Click Create Policy.
9. Click Add Rules.

10. Enter a name and make sure the following options are selected:

    • Add Check-in Client Credentials.
    • Add Check-in Authorization Code.

11. Click Create Rule.

curl --location --request GET 'https://<OKTA_ACCOUNT>.okta.com/api/v1/users/me' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: SSWS <TOKEN>'

curl --location --request GET 'https://<OKTA_ACCOUNT>.okta.com/api/v1/users/<USER_ID>/clients/<CLIENT_ID>/grants' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: SSWS <TOKEN>'

curl --location --request DELETE 'https://<OKTA_ACCOUNT>.okta.com/api/v1/users/<USER_ID>/grants/<GRANT_ID>' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: SSWS <TOKEN>'

Register an application for Snowflake Resource in Microsoft Entra ID:

1. Go to MS Azure > Microsoft Entra ID > App registrations.

2. Click New registration.

   • Under Name, enter Snowflake OAuth Resource.
   • Under Supported account types, select Accounts in this organizational directory only.
   • Under Redirect URI, select Web and enter https://<datarobot_app_server>/account/snowflake/snowflake_authz_return.
   • Click Register.

3. Expose the API.

   • Click the set link next to Application ID URI make sure it is a unique ID (this does not need any change ). This will be the <SNOWFLAKE_APPLICATION_ID_URI> value.
   • Click Add a scope to add a scope representing the Snowflake role.
   • Using the name of the role in Snowflake, enter the scope as follows: session:scope:<snowflake_role_name>. If it's a custom role, set the role name in Snowflake, and enter the scope as follows: session:scope:<custom_role_name>.
   • Add another scope name as session:role-any.
   • Copy the value of the newly created scope. This will be <OAUTH_SCOPES> value.

Register an application for Snowflake Client App in Microsoft Entra ID:

1. Go to MS Azure > Microsoft Entra ID > App registrations.

2. Click New registration.

   • Under Name, enter Snowflake OAuth Client.
   • Under Supported account types, select Accounts in this organizational directory only.
   • Under Redirect URI, select Web and enter https://<datarobot_app_server>/account/snowflake/snowflake_authz_return.
   • Click Register.

3. In the Overview section, copy the client ID from the Application (client) ID field. This will be known as the <OAUTH_CLIENT_ID>.

4. Open Certificates & secrets and select New client secret.
5. Click Add. Copy the secret. This will be known as the <OAUTH_CLIENT_SECRET>.

6. Optional For programmatic clients that need to request an access token on behalf of a user, configure delegated permissions for applications as follows:

   • Click API Permissions.
   • Click Add Permission.
   • Click on My APIs.
   • Click on the Snowflake OAuth Resource that you created in Step 1: Configure the OAuth Resource in Entra ID.
   • Click on the Delegated Permissions box.
   • Check on the Permission related to the Scopes created in step 3 session:role-any
   • Click Add Permissions.

Collect the following information for the Snowflake integration:

• Click App Registrations.
• Click the Snowflake OAuth Resource.
• On the Overview page, click Endpoints.
• Copy the first part of the OAuth 2.0 token endpoint (v2) URL, e.g. https://login.microsoftonline.com/6064c47c-80e4-4a555b-82ee-1fc5643b37a2. This will be <ISSUER_URL> value
• Copy the value of OpenID Connect metadata document and paste it on a new window. Locate the "jwks_uri" parameter, which will be the <JWS_KEY_ENDPOINT> value (e.g., https://login.microsoftonline.com/6064c47c-80e4555b-82ee-1fc5643b37a2/discovery/v2.0/keys).
• Copy the value of Federation metadata document and open the URL in a new window. Locate the "entityID" parameter, which will be the <ENTITY_ID> value, also known as <AZURE_AD_ISSUER> (e.g., https://sts.windows.net/6064c47c-80e4-555582ee-1fc5643b37a2/).

Make sure you've copied the following values:

• <OAUTH_SCOPES> copied from Snowflake OAuth Resource.

• <APP_ID_URI>, <ISSUER_URL>, <JWS_KEY_ENDPOINT> and <ENTITY_ID> values from the Overview and Endpoints view of Snowflake OAuth Resource.

• <OAUTH_CLIENT_ID> and <OAUTH_CLIENT_SECRET> copied from Snowflake OAuth Client.

create security integration external_oauth_okta_2
    type = external_oauth
    enabled = true
    external_oauth_type = okta
    external_oauth_issuer = '<OKTA_ISSUER>'
    external_oauth_jws_keys_url = '<JWKS_URI>'
    external_oauth_audience_list = ('<AUDIENCE>')
    external_oauth_token_user_mapping_claim = 'sub'
    external_oauth_snowflake_user_mapping_attribute = 'login_name';

CREATE OR REPLACE USER <user_name>
  LOGIN_NAME = '<okta_user_name>';

alter user <user_name> set DEFAULT_ROLE = 'PUBLIC';

Reference values:

• OKTA_ISSUER: https://dev-11863425.okta.com/oauth2/aus15ca55wxplJ5d7

• AUDIENCE: https://hl91180.us-east-2.aws.snowflakecomputing.com/

• JWKS_URI: https://dev-11863425.okta.com/oauth2/aus15ca55wxplJ5d7/v1/keys (retrieved from Okta Auth server Metadata JSON)

• okta_user_name (retrieved from Okta > Directory > People, select a user, and then go to Profile > Username/login )

create security integration external_oauth_azure_1
   type = external_oauth
   enabled = true
   external_oauth_type = azure
   external_oauth_issuer = '<ENTITY_ID>'
   external_oauth_jws_keys_url = '<JWS_KEY_ENDPOINT>'
   external_oauth_audience_list = ('<APP_ID_URI>')
   external_oauth_token_user_mapping_claim = 'upn'
   external_oauth_any_role_mode = 'ENABLE'
   external_oauth_snowflake_user_mapping_attribute = 'login_name';

• <ENTITY_ID>: https://sts.windows.net/6064c47c-80e4-4a2b-4444-1fc5643b37a2/

• <JWS_KEY_ENDPOINT>: https://login.microsoftonline.com/6064c47c-80e4-4a2b-4444-1fc5643b37a2/discovery/v2.0/keys

• <APP_ID_URI>: api://8aa2572f-c9e6-4e91-4444-dcd84c856dd2

Grant access on the integration to the public role:

grant USE_ANY_ROLE on integration external_oauth_azure_1 to PUBLIC;

grant USE_ANY_ROLE on integration external_oauth_azure_1 to <custom_role>;

Ensure that the LOGIN_NAME of the user is the same as the Azure login. Verify using the following query in Snowflake:

DESC USER <SNOWFLAKE_LOGIN_NAME>

If the login names are different, Snowflake cannot validate the access token generated with Entra ID. In that case, use the command below to match Snowflake with Azure:

ALTER USER <SNOWFLAKE_LOGIN_NAME> SET LOGIN_NAME='<EMAIL_USED_FOR_AZURE_LOGIN>'

If you are using custom role and is not your default, use the command below to set it as your default to test connectivity:

ALTER USER <USERNAME> SET DEFAULT ROLE='<custom_role>';