Categories:

User & Security DDL (Third-Party Service Integrations)

ALTER SECURITY INTEGRATION

Snowflake logo in black (no text) Preview Feature — Open

Available to all accounts.

Modifies the properties for an existing security integration.

See also:

CREATE SECURITY INTEGRATION , DROP INTEGRATION , SHOW INTEGRATIONS

In this Topic:

Syntax

External OAuth

ALTER [ SECURITY ] INTEGRATION [ IF EXISTS ] <name> SET
  [ TYPE = EXTERNAL_OAUTH ]
  [ ENABLED = { TRUE | FALSE } ]
  [ EXTERNAL_OAUTH_TYPE = { OKTA | AZURE | PING_FEDERATE | CUSTOM } ]
  [ EXTERNAL_OAUTH_ISSUER = '<string_literal>' ]
  [ EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = '<string_literal>' ]
  [ EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'LOGIN_NAME | EMAIL_ADDRESS' ]
  [ EXTERNAL_OAUTH_JWS_KEYS_URL = '<string_literal>' ]
  [ EXTERNAL_OAUTH_RSA_PUBLIC_KEY = <public_key1> ]
  [ EXTERNAL_OAUTH_RSA_PUBLIC_KEY_2 = <public_key2> ]
  [ EXTERNAL_OAUTH_AUDIENCE_LIST = ('<string_literal>') ]

SAML2

ALTER [ SECURITY ] INTEGRATION [ IF EXISTS ] <name> SET
    [ TYPE = SAML2 ]
    [ ENABLED = TRUE | FALSE ]
    [ SAML2_ISSUER = '<string_literal>' ]
    [ SAML2_SSO_URL = '<string_literal>' ]
    [ SAML2_PROVIDER = '<string_literal>' ]
    [ SAML2_X509_CERT = '<string_literal>' ]
    [ SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = '<string_literal>' ]
    [ SAML2_ENABLE_SP_INITIATED = TRUE | FALSE ]
    [ SAML2_SNOWFLAKE_X509_CERT = '<string_literal>' ]
    [ SAML2_SIGN_REQUEST = TRUE | FALSE ]
    [ SAML2_REQUESTED_NAMEID_FORMAT = '<string_literal>' ]

SCIM

ALTER [ SECURITY ] INTEGRATION [ IF EXISTS ] <name> SET
    [ TYPE = SCIM ]
    [ SCIM_CLIENT = 'OKTA' | 'AZURE' | 'CUSTOM' ]
    [ RUN_AS_ROLE = 'OKTA_PROVISIONER' | 'AAD_PROVISIONER' | 'GENERIC_SCIM_PROVISIONER' ]
    [ NETWORK_POLICY  = '<network_policy>' ]

Snowflake OAuth for Partner applications

ALTER [ SECURITY ] INTEGRATION [ IF EXISTS ] <name> SET
  [ ENABLED = { TRUE | FALSE } ]
  [ OAUTH_ISSUE_REFRESH_TOKENS = TRUE | FALSE ]
  [ OAUTH_REFRESH_TOKEN_VALIDITY = <integer> ]
  [ BLOCKED_ROLES_LIST = ( '<role_name>' [ , '<role_name>' , ... ] ) ]
  [ COMMENT = '<string_literal>' ]

Snowflake OAuth for Custom clients

ALTER [ SECURITY ] INTEGRATION [ IF EXISTS ] <name> SET
  [ ENABLED = { TRUE | FALSE } ]
  [ OAUTH_REDIRECT_URI = '<uri>' ]
  [ OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE | FALSE ]
  [ OAUTH_ENFORCE_PKCE = TRUE | FALSE ]
  [ PRE_AUTHORIZED_ROLES_LIST = ( '<role_name>' [ , '<role_name>' , ... ] ) ]
  [ BLOCKED_ROLES_LIST = ( '<role_name>' [ , '<role_name>' , ... ] ) ]
  [ OAUTH_ISSUE_REFRESH_TOKENS = TRUE | FALSE ]
  [ OAUTH_REFRESH_TOKEN_VALIDITY = <integer> ]
  [ NETWORK_POLICY = '<network_policy>' ]
  [ OAUTH_CLIENT_RSA_PUBLIC_KEY = <public_key1> ]
  [ OAUTH_CLIENT_RSA_PUBLIC_KEY_2 = <public_key2> ]
  [ COMMENT = '{string_literal}' ]

Parameters

name

Identifier for the integration to alter. If the identifier contains spaces or special characters, the entire string must be enclosed in double quotes. Identifiers enclosed in double quotes are also case-sensitive.

External OAuth Parameters

SET ...

Specifies one (or more) properties/parameters to set for the integration (separated by blank spaces, commas, or new lines):

TYPE = EXTERNAL_OAUTH

Distinguishes the External OAuth integration from a Snowflake OAuth integration.

ENABLED = TRUE | FALSE

Specifies whether to initiate operation of the integration or suspend it.

  • TRUE allows the integration to run based on the parameters specified in the pipe definition.

  • FALSE suspends the integration for maintenance. Any integration between Snowflake and a third-party service fails to work.

EXTERNAL_OAUTH_TYPE = OKTA | AZURE | PING_FEDERATE | CUSTOM

Specifies the OAuth 2.0 authorization server to be Okta, Microsoft Azure AD, Ping Identity PingFederate, or a Custom OAuth 2.0 authorization server.

EXTERNAL_OAUTH_ISSUER = 'string_literal'

Specifies the URL to define the OAuth 2.0 authorization server.

EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'string_literal'

Specifies which access token claim should be used to map the access token to a Snowflake user record. The type of the claim must be a string or an array of strings with a single entry.

EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'LOGIN_NAME | EMAIL_ADDRESS'

Indicates which Snowflake user record attribute should be used to map the access token to a Snowflake user record.

EXTERNAL_OAUTH_JWS_KEYS_URL = 'string_literal'

Specifies the endpoint from which to download public keys or certificates to validate an External OAuth access token.

EXTERNAL_OAUTH_RSA_PUBLIC_KEY = public_key1

Specifies a Base64-encoded RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers.

EXTERNAL_OAUTH_RSA_PUBLIC_KEY_2 = public_key2

Specifies a second RSA public key, without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- headers. Used for key rotation.

EXTERNAL_OAUTH_AUDIENCE_LIST = ('string_literal')

Specifies additional values that can be used for the access token’s audience validation on top of using the Customer’s Snowflake Account URL (e.g. <account>.<region>.snowflakecomputing.com).

SAML 2.0 Parameters

SET ...

Specifies one (or more) properties/parameters to set for the integration (separated by blank spaces, commas, or new lines):

TYPE = SAML2

Specify the type of integration:

  • SAML2: Creates a security interface between Snowflake and the identity provider.

ENABLED = TRUE | FALSE

Specifies whether to initiate operation of the integration or suspend it.

  • TRUE allows the integration to run based on the parameters specified in the pipe definition.

  • FALSE suspends the integration for maintenance. Any integration between Snowflake and a third-party service fails to work.

SAML2_ISSUER = 'string_literal'

The string containing the IdP EntityID / Issuer.

SAML2_SSO_URL = 'string_literal'

The string containing the IdP SSO URL, where the user should be redirected by Snowflake (the Service Provider) with a SAML AuthnRequest message.

SAML2_PROVIDER = 'string_literal'

The string describing the IdP.

One of the following: OKTA, ADFS, Custom.

SAML2_X509_CERT = 'string_literal'

The Base64 encoded IdP signing certificate on a single line without the leading -----BEGIN CERTIFICATE----- and ending -----END CERTIFICATE----- markers.

SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'string_literal'

The string containing the label to display after the Log In With button on the login page.

SAML2_ENABLE_SP_INITIATED = TRUE | FALSE

The Boolean indicating if the Log In With button will be shown on the login page.

  • TRUE displays the Log in With button on the login page.

  • FALSE does not display the Log in With button on the login page..

SAML2_SNOWFLAKE_X509_CERT = 'string_literal'

The Base64 encoded self-signed certificate generated by Snowflake for use with Encrypting SAML Assertions and Signed SAML Requests.

You must have at least one of these features (encrypted SAML assertions or signed SAML responses) enabled in your Snowflake account to access the certificate value.

SAML2_SIGN_REQUEST = TRUE | FALSE

The Boolean indicating whether SAML requests are signed.

  • TRUE allows SAML requests to be signed.

  • FALSE does not allow SAML requests to be signed.

SAML2_REQUESTED_NAMEID_FORMAT = 'string_literal'

The SAML NameID format allows Snowflake to set an expectation of the identifying attribute of the user (i.e. SAML Subject) in the SAML assertion from the IdP to ensure a valid authentication to Snowflake. If a value is not specified, Snowflake sends the urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress value in the authentication request to the IdP.

Optional.

If you choose to specify the SAML NameID format, use one of the following values:

  • urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

  • urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

  • urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName

  • urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName

  • urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos

  • urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

  • urn:oasis:names:tc:SAML:2.0:nameid-format:transient

SCIM Parameters

TYPE = SCIM

Specify the type of integration:

  • SCIM: Creates a security interface between Snowflake and a client that supports SCIM.

SCIM_CLIENT = 'OKTA' | 'AZURE' | 'CUSTOM'

Specify the SCIM client.

RUN_AS_ROLE = 'OKTA_PROVISIONER' | 'AAD_PROVISIONER' | 'GENERIC_SCIM_PROVISIONER'

Specify the SCIM role in Snowflake that owns any users and roles that are imported from the identity provider into Snowflake using SCIM.

  • The values OKTA_PROVISIONER, AAD_PROVISIONER, and GENERIC_SCIM_PROVISIONER are case-sensitive and must always be capitalized.

NETWORK_POLICY = 'network_policy'

Specifies an existing network policy active for your account. The network policy restricts the list of user IP addresses when exchanging an authorization code for an access or refresh token and when using a refresh token to obtain a new access token. If this parameter is not set, the network policy for the account (if any) is used instead.

Snowflake OAuth Partner Application Parameters

Valid when OAUTH_CLIENT = <partner_application> (i.e. when creating an integration for a partner application)

SET ...

Specifies one (or more) properties/parameters to set for the integration (separated by blank spaces, commas, or new lines):

ENABLED = TRUE | FALSE Specifies whether to initiate operation of the integration or suspend it.

  • TRUE allows the integration to run based on the parameters specified in the pipe definition.

  • FALSE suspends the integration for maintenance. Any integration between Snowflake and a third-party service fails to work.

OAUTH_ISSUE_REFRESH_TOKENS = TRUE | FALSE

Boolean that specifies whether to allow the client to exchange a refresh token for an access token when the current access token has expired. If set to FALSE, a refresh token is not issued. User consent is revoked, and the user must confirm authorization again.

Default: TRUE

OAUTH_REFRESH_TOKEN_VALIDITY = integer

Integer that specifies how long refresh tokens should be valid (in seconds). This can be used to expire the refresh token periodically.

Note that if your organization would like the minimum or maximum values lowered or raised, respectively, ask your account administrator to send a request to Snowflake Support.

Values

86400 (1 day) to 7776000 (90 days)

Default

7776000

BLOCKED_ROLES_LIST = '( role_name' [ , 'role_name' , ... ] )

Comma-separated list of Snowflake roles that a user cannot explicitly consent to using after authenticating, e.g. 'custom_role1', 'custom_role2'. Note that the ACCOUNTADMIN and SECURITYADMIN roles are included in this list by default; however, if these roles should be removed for your account, ask your account administrator to send a request to Snowflake Support.

COMMENT = 'string_literal'

String (literal) that specifies a comment for the integration.

Snowflake OAuth Custom Client Parameters

Valid when OAUTH_CLIENT = CUSTOM (i.e. when creating an integration for a custom client)

SET ...

Specifies one (or more) properties/parameters to set for the integration (separated by blank spaces, commas, or new lines):

ENABLED = TRUE | FALSE Specifies whether to initiate operation of the integration or suspend it.

  • TRUE allows the integration to run based on the parameters specified in the pipe definition.

  • FALSE suspends the integration for maintenance. Any integration between Snowflake and a third-party service fails to work.

OAUTH_REDIRECT_URI = 'uri'

Specifies the client URI. After a user is authenticated, the web browser is redirected to this URI. The URI must be protected by TLS (Transport Layer Security) unless the optional OAUTH_ALLOW_NON_TLS_REDIRECT_URI parameter is set to TRUE.

OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE | FALSE

If TRUE, allows setting OAUTH_REDIRECT_URI to a URI not protected by TLS. We highly recommend use of TLS to prevent man-in-the-middle OAuth redirects for use in phishing attacks.

Default: FALSE

OAUTH_ENFORCE_PKCE = TRUE | FALSE

Boolean that specifies whether Proof Key for Code Exchange (PKCE) should be required for the integration.

Default: FALSE

PRE_AUTHORIZED_ROLES_LIST = '( role_name' [ , 'role_name , ... ] ')

Comma-separated list of Snowflake roles that a user does not need to explicitly consent to using after authenticating, e.g. 'custom_role1', 'custom_role2'. Note that the ACCOUNTADMIN and SECURITYADMIN roles cannot be included in this list.

Note

This parameter is supported for confidential clients only.

BLOCKED_ROLES_LIST = '(role_name', 'role_name')

Comma-separated list of Snowflake roles that a user cannot explicitly consent to using after authenticating, e.g. 'custom_role1', 'custom_role2'. Note that the ACCOUNTADMIN and SECURITYADMIN roles are included in this list by default; however, if these roles should be removed for your account, ask your account administrator to send a request to Snowflake Support.

OAUTH_ISSUE_REFRESH_TOKENS = TRUE | FALSE

Boolean that specifies whether to allow the client to exchange a refresh token for an access token when the current access token has expired. If set to FALSE, a refresh token is not issued. User consent is revoked, and the user must confirm authorization again.

Default: TRUE

OAUTH_REFRESH_TOKEN_VALIDITY = integer

Integer that specifies how long refresh tokens should be valid (in seconds). This can be used to expire the refresh token periodically.

When a refresh token expires, the application will need to direct the user through the authorization flow again to obtain a new refresh token.

The supported minimum, maximum, and default values are as follows:

Application

Minimum

Maximum

Default

Tableau Desktop

60 (1 minute)

36000 (10 hours)

36000 (10 hours)

Tableau Server or Tableau Online

60 (1 minute)

7776000 (90 days)

7776000 (90 days)

Custom client

86400 (1 day)

7776000 (90 days)

7776000 (90 days)

If you have a business need to lower the minimum value or raise the maximum value, ask your account administrator to send a request to Snowflake Support.

NETWORK_POLICY = 'network_policy'

Specifies an existing network policy active for your account. The network policy restricts the list of user IP addresses when exchanging an authorization code for an access or refresh token and when using a refresh token to obtain a new access token. If this parameter is not set, the network policy for the account (if any) is used instead.

OAUTH_CLIENT_RSA_PUBLIC_KEY = public_key1

Specifies an RSA public key. For more information, see OAuth.

OAUTH_CLIENT_RSA_PUBLIC_KEY_2 = public_key2

Specifies a second RSA public key. Used for key rotation.

COMMENT = 'string_literal'

String (literal) that specifies a comment for the integration.

Examples

The following example initiates operation of a suspended integration:

ALTER SECURITY INTEGRATION myint SET ENABLED = TRUE;