Authentication for local applications: Built-in security integration for Snowflake OAuth

Applications that use Snowflake OAuth to authenticate need a security integration that defines the interface between Snowflake and the application. This change introduces a built-in, system-owned security integration that simplifies how local desktop applications authenticate with Snowflake OAuth.

Note

When this behavior change is enabled, the built-in security integration will be rolled out to accounts slowly, and might not be available immediately.

Before the change:

You must always create and configure a security integration if you want an application to use Snowflake OAuth to authenticate to Snowflake.

After the change:

Local, desktop applications that want to authenticate with Snowflake OAuth don’t have to create a security integration. The built-in security integration SNOWFLAKE$LOCAL_APPLICATION exists in all accounts. It is a security integration of type OAUTH.

Because you don’t need to create a security integration, application developers can implement Snowflake OAuth without the assistance of a Snowflake administrator. But a security administrator can still configure the built-in security integration to control things like the validity duration of access tokens and whether to use single-use refresh tokens.

Only local, desktop applications can authenticate using the built-in security integration. Other types of applications — for example, third-party web applications — must still create and configure a security integration if they want to authenticate with Snowflake OAuth.

Benefits of the built-in integration

Using the SNOWFLAKE$LOCAL_APPLICATION security integration to authenticate local applications has the following benefits:

  • Provides a straightforward authentication method that is an alternative to password authentication, helping you conform to the upcoming Snowflake requirement that human users use multi-factor authentication (MFA) if they authenticate with a password.

  • Reduces administrative friction; no initial administrator action is required to use Snowflake OAuth.

  • Improves the user experience for developers, especially those using the Snowflake CLI.

  • Enables local applications to use OAuth as a singular authentication method, eliminating the need for complex configurations and making the authentication process mostly opaque to the application.

  • Supports in-role session switching like other authentication methods. A user-defined Snowflake OAuth security integration doesn’t support in-role session switching.

  • Isolates local applications from user credentials. This eliminates long-living credentials on disk, meaning sensitive authentication data, such as passwords or personal access tokens, aren’t persisted in an insecure manner.

Having a built-in security integration doesn’t weaken the security posture of your account, but rather combines an enhanced user experience with the most secure form of local authentication. Creating new sessions within the window of OAuth refresh token validity is equivalent to the existing pattern of using saved user credentials to create new sessions. In addition, administrators retain control over authentication by using authentication policies to dictate which credentials are allowed for users.

Opt out of the change

An account administrator can disable the SNOWFLAKE$LOCAL_APPLICATION security integration for an account. This action prevents local applications from using Snowflake OAuth to authenticate unless an administrator creates their own security integration.

To opt out of this change so that security administrators can’t enable the SNOWFLAKE$LOCAL_APPLICATION security integration, run the following commands:

USE ROLE ACCOUNTADMIN;

ALTER ACCOUNT SET DISABLE_SNOWFLAKE_LOCAL_APPLICATION_INTEGRATION = TRUE;
Copy

Using the DISABLE_SNOWFLAKE_LOCAL_APPLICATION_INTEGRATION parameter to opt out doesn’t prevent the SNOWFLAKE$LOCAL_APPLICATION integration from being created. The integration will still exist in your account, but its ENABLED property will be FALSE, and a security administrator can’t change the property to TRUE.

The account administrator can set the DISABLE_SNOWFLAKE_LOCAL_APPLICATION_INTEGRATION parameter before the SNOWFLAKE$LOCAL_APPLICATION integration is created in an account so that the integration is never enabled.

If the account administrator doesn’t use the account parameter to opt out, a security administrator can still disable the SNOWFLAKE$LOCAL_APPLICATION integration after it is created. To disable the built-in security integration after it exists in the account, run the following commands:

USE ROLE SECURITYADMIN;

ALTER SECURITY INTEGRATION SNOWFLAKE$LOCAL_APPLICATION SET ENABLED = FALSE;
Copy

Ref: 2056

Language: English