Authenticating connections¶
To authenticate to Snowflake, you can use one of the following options:
Password-based authentication. To use this, set the
password
option when establishing the connection.Single sign-on (SSO) through a web browser.
Native SSO through Okta.
Using single sign-on (SSO) through a web browser¶
If you have configured Snowflake to use single sign-on (SSO), you can configure your client application to use browser-based SSO for authentication.
In your application code:
Set the
authenticator
option toEXTERNALBROWSER
.To establish a connection, call the
connectAsync
method, rather than theconnect
method.
For example:
// Use a browser to authenticate via SSO.
var connection = snowflake.createConnection({
...,
authenticator: "EXTERNALBROWSER"
});
// Establish a connection. Use connectAsync, rather than connect.
connection.connectAsync(
function (err, conn)
{
... // Handle any errors.
}
).then(() =>
{
// Execute SQL statements.
var statement = connection.execute({...});
});
For more information about using browser-based SSO for authentication, see Browser-based SSO.
Using native SSO through Okta¶
If you have configured Snowflake to use single sign-on (SSO) through Okta, you can configure your client application to use native SSO authentication through Okta.
In your application code:
Set the following options:
Set the
authenticator
option to the Okta URL endpoint for your Okta account (e.g.https://<okta_account_name>.okta.com
).Set the
username
andpassword
options to the user name and password for your Identity Provider (IdP).
To establish a connection, call the
connectAsync
method, rather than theconnect
method.
For example:
// Use native SSO authentication through Okta.
var connection = snowflake.createConnection({
...,
username: '<user_name_for_okta>',
password: '<password_for_okta>',
authenticator: "https://myaccount.okta.com"
});
// Establish a connection.
connection.connectAsync(
function (err, conn)
{
... // Handle any errors.
}
);
// Execute SQL statements.
var statement = connection.execute({...});
For more information about using native SSO authentication through Okta, see Native SSO — Okta only.
Using key-pair authentication and key-pair rotation¶
The driver supports key pair authentication and key rotation. To use key-pair authentication and key rotation, follow the steps below:
Configure key pair authentication, as explained in Key-pair authentication and key-pair rotation.
In your application code:
Set the
authenticator
option toSNOWFLAKE_JWT
.Use the private key to authenticate in one of the following ways:
Set the
privateKey
option to the private key.Set the
privateKeyPath
option to the path to the private key file.If the file is encrypted, you must also set the
privateKeyPass
option to the passphrase to decrypt the private key.
The following example loads the private key from a file and sets the
privateKey
option to the private key:// Read the private key file from the filesystem. var crypto = require('crypto'); var fs = require('fs'); var privateKeyFile = fs.readFileSync('<path_to_private_key_file>/rsa_key.p8'); // Get the private key from the file as an object. const privateKeyObject = crypto.createPrivateKey({ key: privateKeyFile, format: 'pem', passphrase: 'passphrase' }); // Extract the private key from the object as a PEM-encoded string. var privateKey = privateKeyObject.export({ format: 'pem', type: 'pkcs8' }); // Use the private key for authentication. var connection = snowflake.createConnection({ ... authenticator: "SNOWFLAKE_JWT", privateKey: privateKey }); // Establish a connection. connection.connect( function (err, conn) { ... // Handle any errors. } ); // Execute SQL statements. var statement = connection.execute({...});The following example sets the
privateKeyPath
option to an encrypted private key file and sets theprivateKeyPass
option to the passphrase used to decrypt the private key:// Use an encrypted private key file for authentication. // Specify the passphrase for decrypting the key. var connection = snowflake.createConnection({ ... authenticator: "SNOWFLAKE_JWT", privateKeyPath: "<path-to-privatekey>/privatekey.p8", privateKeyPass: '<passphrase_to_decrypt_the_private_key>' }); // Establish a connection. connection.connect( function (err, conn) { ... // Handle any errors. } ); // Execute SQL statements. var statement = connection.execute({...});
Using OAuth¶
To connect using OAuth, set the authenticator
option to OAUTH
and the token
option to the OAuth access
token. For example:
// Use OAuth for authentication.
var connection = snowflake.createConnection({
...
authenticator: "OAUTH",
token: "<your_oauth_token>"
});
// Establish a connection.
connection.connect(
function (err, conn)
{
... // Handle any errors.
}
);
// Execute SQL statements.
var statement = connection.execute({...});
For more information, see Clients, drivers, and connectors.