Snowflake Security Integrations: Designing and Implementing SAML/OAuth

A Security Integration is an account-level object that connects Snowflake to an external identity provider (IdP) or authorization server. You choose the TYPE parameter based on the use case: SAML 2.0 for SSO, External OAuth for token-based authentication, or Snowflake OAuth for OAuth into Snowsight and official connectors. Creating one requires the ACCOUNTADMIN role (or the CREATE INTEGRATION privilege).

How SAML 2.0 Security Integrations Work

In a SAML 2.0 integration, Snowflake acts as the Service Provider (SP) and the external IdP acts as the Identity Provider. When a user accesses Snowsight, Snowflake redirects a SAML authentication request to the configured IdP, which returns a SAML response (Assertion) to Snowflake after authentication. Snowflake validates the Assertion's signature using the X.509 certificate, identifies the Snowflake user from the NameID, and establishes the session.

Creating a SAML2 Security Integration

-- SAML 2.0 Security Integration (Okta example)
CREATE SECURITY INTEGRATION okta_saml_integration
  TYPE = SAML2
  ENABLED = TRUE
  SAML2_ISSUER = 'http://www.okta.com/exk1234567890'
  SAML2_SSO_URL = 'https://myorg.okta.com/app/snowflake/exk1234567890/sso/saml'
  SAML2_PROVIDER = 'OKTA'
  SAML2_X509_CERT = 'MIIDpDCCAoygAw...base64 certificate...'
  SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'Okta SSO Login'
  SAML2_ENABLE_SP_INITIATED = TRUE;

-- For Azure AD
CREATE SECURITY INTEGRATION azure_ad_saml_integration
  TYPE = SAML2
  ENABLED = TRUE
  SAML2_ISSUER = 'https://sts.windows.net/<tenant-id>/'
  SAML2_SSO_URL = 'https://login.microsoftonline.com/<tenant-id>/saml2'
  SAML2_PROVIDER = 'CUSTOM'
  SAML2_X509_CERT = 'MIIDpDCCAoygAw...base64 certificate...'
  SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'Azure AD SSO'
  SAML2_ENABLE_SP_INITIATED = TRUE
  SAML2_SNOWFLAKE_ACS_URL = 'https://<account>.snowflakecomputing.com/fed/login'
  SAML2_SNOWFLAKE_ISSUER_URL = 'https://<account>.snowflakecomputing.com';

IdP Configuration Comparison

External OAuth Security Integration

With External OAuth, Snowflake validates an access token issued by an external authorization server (Azure AD, Okta, or a custom OAuth 2.0 server) and establishes the session. Use it when connecting from BI tools or custom applications to Snowflake without passwords.

-- External OAuth (Azure AD example)
CREATE SECURITY INTEGRATION azure_external_oauth
  TYPE = EXTERNAL_OAUTH
  ENABLED = TRUE
  EXTERNAL_OAUTH_TYPE = AZURE
  EXTERNAL_OAUTH_ISSUER = 'https://sts.windows.net/<tenant-id>/'
  EXTERNAL_OAUTH_JWS_KEYS_URL = 'https://login.microsoftonline.com/<tenant-id>/discovery/v2.0/keys'
  EXTERNAL_OAUTH_AUDIENCE_LIST = ('https://<account>.snowflakecomputing.com')
  EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'upn'
  EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'LOGIN_NAME'
  EXTERNAL_OAUTH_ANY_ROLE_MODE = 'ENABLE';

Snowflake OAuth Security Integration

Snowflake OAuth is the pattern where Snowflake itself acts as the authorization server. It is used for authentication in Snowsight and the official drivers/connectors, with client_id/client_secret managed on the client application side.

-- Snowflake OAuth Integration
CREATE SECURITY INTEGRATION snowflake_oauth_tableau
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = TABLEAU_DESKTOP
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 86400;

-- For custom clients
CREATE SECURITY INTEGRATION snowflake_oauth_custom
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://myapp.example.com/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

Security Integration Management Commands

-- List integrations
SHOW SECURITY INTEGRATIONS;

-- View details (settings and SAML SP info)
DESCRIBE SECURITY INTEGRATION okta_saml_integration;

-- Rotate the certificate
ALTER SECURITY INTEGRATION okta_saml_integration
  SET SAML2_X509_CERT = 'MIIDpDCCAoygAw...new certificate...';

-- Temporarily disable
ALTER SECURITY INTEGRATION okta_saml_integration SET ENABLED = FALSE;

-- Delete
DROP SECURITY INTEGRATION okta_saml_integration;

Choosing an Authentication Method

Troubleshooting

• "User not found" error after SSO: The NameID sent by the IdP (typically an email address) does not match the Snowflake user's LOGIN_NAME or EMAIL. Use DESCRIBE SECURITY INTEGRATION to check the SAML2_SNOWFLAKE_USER_MAPPING_ATTRIBUTE setting.
• "Invalid SAML response" error: X.509 certificate mismatch is the most common cause. Check whether the IdP has rotated its certificate and update it via ALTER SECURITY INTEGRATION.
• Roles unavailable with External OAuth: When EXTERNAL_OAUTH_ANY_ROLE_MODE is DISABLE (the default), only roles contained in the token's scope are usable. Set it to ENABLE, or include role names in the scope.

Check Your Understanding

Frequently Asked Questions