Configure Snowflake OAuth for partner applications¶

Blocking specific roles from using the integration¶

The optional BLOCKED_ROLES_LIST parameter allows you to list Snowflake roles that a user cannot explicitly consent to using with the integration.

By default, the ACCOUNTADMIN, SECURITYADMIN, GLOBALORGADMIN, and ORGADMIN roles are included in this list and cannot be removed. If you have a business need to allow users to use Snowflake OAuth with these roles, and your security team allows it, please contact Snowflake Support to request that these roles be allowed for your account.

Controlling the login frequency¶

When a user has authenticated successfully, the partner application can use the issued refresh token to request new, short-lived access tokens, and not prompt the user to repeat the login process until the refresh token expires. The optional OAUTH_REFRESH_TOKEN_VALIDITY parameter specifies the length of time a refresh token is valid (in seconds). This setting can be used to expire the refresh token periodically, forcing the user to repeat the login process.

The supported minimum, maximum, and default values for the OAUTH_REFRESH_TOKEN_VALIDITY parameter are as follows:

If you have a business need to lower the minimum value or raise the maximum value, please contact Snowflake Support to request the change for your account.

Using Client Redirect with Snowflake OAuth for partner applications¶

Snowflake supports using Client Redirect with Snowflake OAuth for Partner Applications, including using Client Redirect and Snowflake OAuth with supported Snowflake Clients.

For more information, see Redirecting client connections.

Managing network policies¶

Snowflake supports network policies for Snowflake OAuth. For more information, see Network policies.

Examples¶

Tableau Desktop

The following example creates a Snowflake OAuth integration with the default settings:

CREATE SECURITY INTEGRATION td_oauth_int1
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = TABLEAU_DESKTOP;

Copy

View the integration settings using DESCRIBE INTEGRATION:

DESC SECURITY INTEGRATION td_oauth_int1;

Copy

The following example creates a Snowflake OAuth integration with refresh tokens that expire after 10 hours (36000 seconds). The integration blocks users from starting a session with SYSADMIN as the active role:

CREATE SECURITY INTEGRATION td_oauth_int2
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 36000
  BLOCKED_ROLES_LIST = ('SYSADMIN')
  OAUTH_CLIENT = TABLEAU_DESKTOP;

Copy

Tableau Cloud

The following example creates a Snowflake OAuth integration with the default settings:

CREATE SECURITY INTEGRATION ts_oauth_int1
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = TABLEAU_SERVER;

Copy

View the integration settings using DESCRIBE INTEGRATION:

DESC SECURITY INTEGRATION ts_oauth_int1;

Copy

The following example creates a Snowflake OAuth integration with refresh tokens that expire after 1 day (86400 seconds). The integration blocks users from starting a session with SYSADMIN as the active role:

CREATE SECURITY INTEGRATION ts_oauth_int2
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = TABLEAU_SERVER
  OAUTH_REFRESH_TOKEN_VALIDITY = 86400
  BLOCKED_ROLES_LIST = ('SYSADMIN');

Copy

Tableau¶

Follow the instructions provided by Tableau to connect to Snowflake using Snowflake OAuth.

Looker¶

Follow the steps provided by Looker to connect to Snowflake using Snowflake OAuth.

Alation¶

Access the Alation Community and follow the instructions provided by Alation to connect to Snowflake using Snowflake OAuth.

ThoughtSpot¶

Access the ThoughtSpot documentation and follow the instructions to create a connection to Snowflake, which includes a step on how to configure Snowflake OAuth.

Collibra¶

Access the Collibra Documentation and follow the instructions provided by Collibra to connect to Snowflake using Snowflake OAuth.

Display Snowflake OAuth consents¶

List the active delegated authorizations for which you have access privileges, using SHOW DELEGATED AUTHORIZATIONS:

SHOW DELEGATED AUTHORIZATIONS;

+-------------------------------+-----------+-----------+-------------------+--------------------+
| created_on                    | user_name | role_name | integration_name  | integration_status |
|-------------------------------+-----------+-----------+-------------------+--------------------|
| 2018-11-27 07:43:10.914 -0800 | JSMITH    | PUBLIC    | MY_OAUTH_INT      | ENABLED            |
+-------------------------------+-----------+-----------+-------------------+--------------------+

List the active delegated authorizations for a specified user. Users can list their own delegated authorizations; otherwise, this command variant requires the OWNERSHIP privilege on the user.

SHOW DELEGATED AUTHORIZATIONS
    BY USER <username>;

List the active delegated authorizations for a specified integration. This command variant requires the OWNERSHIP privilege on the integration (i.e. the ACCOUNTADMIN role):

SHOW DELEGATED AUTHORIZATIONS
    TO SECURITY INTEGRATION <integration_name>;

Revoke consent¶

A user can revoke consent from a specified integration. This has the effect of revoking any access token associated with the integration.

To revoke user consent for a given integration, execute the ALTER USER … REMOVE DELEGATED AUTHORIZATIONS command.

ALTER USER <username> REMOVE DELEGATED AUTHORIZATIONS
    FROM SECURITY INTEGRATION <integration_name>

Where:

username

Specifies the user whose consent you are revoking.

integration_name

Specifies the integration associated with the access tokens for a specific client.

To revoke user consent associated with a specific role, include the OF ROLE role_name parameter in the statement:

ALTER USER <username> REMOVE DELEGATED AUTHORIZATION
    OF ROLE <role_name>
    FROM SECURITY INTEGRATION <integration_name>

Where:

role_name

Specifies the role associated with the access token.

Any access tokens associated with the role are revoked.