January 29-30, 2024 — 8.4 Release Notes

Attention

The release has completed.

For differences between the in-advance and final versions of these release notes, see Release Notes Change Log.

Security Updates

Authentication enhancements — Preview

With this release, we are pleased to announce the preview of several enhancements related to authentication, including:

  • Authentication policies.

  • Identifier-first login flow.

  • Support for implementing federated authentication using multiple identity providers.

  • New SAML2 security integration parameters for federated authentication.

Authentication policies

Authentication policies provide control over how a client or user authenticates. They can be used to restrict logins based on the type of client trying to connect (for example, allowing Snowsight while blocking SnowSQL), as well as regulating which authentication methods can be used (for example, allowing passwords while blocking key pair authentication).

For more information, see Authentication policies.

Identifier-first login flow

The identifier-first login flow first prompts the user for a username or email address before presenting authentication options. These authentication options are based on rules defined in authentication policies and SAML2 security integrations. For example, the combination of an authentication policy and the identifier-first login flow can hide the password option from a user who needs to be authenticating with an identity provider, which reduces confusion and improves the user experience.

For more information about this feature and how to enable it, see Identifier-first login.

Multiple identity providers support

Snowflake now supports multiple identity providers, which allows different users to authenticate with different identity providers. This feature requires the identifier-first login flow to be enabled.

For more information, see Using multiple identity providers for federated authentication.

New properties for SAML2 security integrations

A SAML2 security integration for a federated authentication configuration can include two new properties:

  • ALLOWED_USER_DOMAINS

  • ALLOWED_EMAIL_PATTERNS

When the user logs in, the user’s email address must match the values specified in these properties in order to authenticate with the identity provider associated with the security integration.

This feature requires the identifier-first login flow to be enabled.

For more information, see CREATE SECURITY INTEGRATION (SAML2).

Virtual Warehouse Updates

Larger warehouses — General Availability in Microsoft Azure Regions

With this release, we are pleased to announce the general availability of larger (5X-LARGE and 6X-LARGE) warehouses in Microsoft Azure regions, excluding Azure Government regions.

Before provisioning a 5X-LARGE or 6X-LARGE warehouse, please contact Snowflake Support.

For more information, see Overview of Warehouses.

Extensibility Updates

External network access — Preview

With this release, we are pleased to announce the addition of preview support for external network access on Google Cloud. You can use external access to access network locations external to Snowflake from within procedure and UDF handler code. In addition to AWS and Azure, this preview is now available on GCP except in the Gov region.

When setting up external network access, you create a network rule that represents the external network location. If your handler code will need to authenticate with the external location, you create a secret containing the credentials needed. In handler code, you can use APIs to retrieve credential values from the secret.

For more information, see External network access overview.

Java 17 support — Preview

With this release, we are pleased to announce the addition of preview support for Java 17 in Snowpark. You can now create and run Stored Procedures and UDFs using Java 17. The Snowpark API and JDBC Driver have also been updated to support Java 17.

For more information on Java support, see Snowflake Java Runtime Support.

Data Loading / Unloading Updates

Snowpipe update: a new pipe status

With this release, a new pipe status STOPPED_BY_SNOWFLAKE_ADMIN is available in the output of SYSTEM$PIPE_STATUS function. The pipe can only be set to this state by Snowflake Support. When a pipe is in this state, it means the pipe will not accept new files for ingestion.

For more information, see SYSTEM$PIPE_STATUS.

Data Pipeline Updates

Automatic task graph retry — General Availability

With this release, we are pleased to announce the general availability of automatic task graph retry. If any task graphs complete in a FAILED state, Snowflake can automatically retry the task graphs. This feature is disabled by default. To enable this feature, you need to set AUTO_RETRY_ATTEMPTS to a value greater than 0 on the root task of a task graph.

For more information, see CREATE TASK and ALTER TASK.

Release Notes Change Log

Announcement

Update

Date

Release notes

Initial publication (preview)

29-Jan-24

Snowpipe update: a new pipe status

Added to Data Loading / Unloading Updates

30-Jan-24

Automatic task graph retry

Added to Data Pipeline Updates

31-Jan-24