OAuth support for Snowflake

Ramya Priya Updated by Ramya Priya

In addition to the direct access method (using user name and password), Tinace offers OAuth-based authentication to access data from Snowflake.

Once you choose Snowflake as your datasource, you will get the option to choose OAuth-based authentication or a direct way of authentication (using username and password). For direct access method, please refer to this page. 

OAuth-based authentication for Snowflake
According to the Snowflake Enterprise and IT guidelines, commercial service accounts will be decommissioned and flagged as not secure. Tinace recommends following OAuth-based authentication.

Setting up OAuth configuration in Snowflake

If you chose OAuth as the authentication mechanism, then you need to configure OAuth in Snowflake.

  1. Run the following command from the Snowflake database console.
create security integration oauth_Tinace
type = oauth
enabled = true
oauth_client = custom
oauth_client_type = 'CONFIDENTIAL'
oauth_redirect_uri = 'https://<Tinace URL>/datasource/snowflake/redirect'  oauth_issue_refresh_tokens = true
oauth_refresh_token_validity = 777600
  1. Run the following command to get Authorization URL and Access Token URL for integration.
describe security integration oauth_Tinace;
  1. Once the above commands are executed, you will get an output similar to the table shown below:
property
property_type
property_value
property_default

ENABLED

Boolean

TRUE

FALSE

OAUTH_REDIRECT_URI

String

https://localhost:8080/sso

OAUTH_CLIENT_TYPE

String

CONFIDENTIAL

CONFIDENTIAL

OAUTH_ISSUE_REFRESH_TOKENS

Boolean

TRUE

TRUE

OAUTH_REFRESH_TOKEN_VALIDITY

Integer

864000

7776000

OAUTH_ENFORCE_PKCE

Boolean

FALSE

FALSE

OAUTH_USE_SECONDARY_ROLES

String

NONE

NONE

OAUTH_CLIENT_ID

String

Sf66uk4V+OR3hbZN+Fnr/ayJV+s=

OAUTH_AUTHORIZATION_ENDPOINT

String

https://Tinacepartner.snowflakecomputing.com/oauth/authorize

OAUTH_TOKEN_ENDPOINT

String

https://Tinacepartner.snowflakecomputing.com/oauth/token-request

OAUTH_ALLOWED_AUTHORIZATION_ENDPOINTS

List

https://Tinacepartner.snowflakecomputing.com/oauth/authorize,https://fryefnr-Tinacepartner.snowflakecomputing.com/oauth/authorize

[]

OAUTH_ALLOWED_TOKEN_ENDPOINTS

List

https://Tinacepartner.snowflakecomputing.com/oauth/token-request,https://fryefnr-Tinacepartner.snowflakecomputing.com/oauth/token-request

[]

  1. Run the following command to obtain Client Secret and Client ID.
select system$show_auth_client_secrets('oauth_Tinace')
  1. An output similar to the one shown below will be displayed.
{"OAUTH_CLIENT_SECRET_2":"xxxxxxxxxxxxxxxxxxxxx",
"OAUTH_CLIENT_SECRET":"xxxxxxxxxxxxxxxxxxxxx",
"OAUTH_CLIENT_ID":"xxxxxxxxxxxxxxxxxxxxx"}
  1. Copy the OAUTH_CLIENT_SECRET and OAUTH_CLIENT_ID to paste them into the Client Secret and Client ID fields, respectively (from the Tinace interface). 
OAuth-based authentication for Snowflake

After configuring OAuth in Snowflake, perform the following steps from Tinace:

  1. Switch on the toggle near Use validated datasource connection details to use an already established connection. The other fields would be auto-filled.
  2. If you’re establishing a new connection, then provide the Snowflake URL, user, client ID, client secret, role, and datasource name.
  3. Once you click on Authorize, Tinace sends an authorization request to the Snowflake authorization server, and you will be redirected to the following window:
Redirection to Snowflake site
  1. In addition to requesting a username and password, Snowflake also seeks your consent so that Tinace can access and retrieve your data from Snowflake.
  2. Once you submit your consent, Tinace gets authorized to act on your behalf.
  3. Snowflake server sends an authorization code to Tinace.

Getting access token

  1. Now, Tinace sends the authorization code back to the Snowflake server seeking an access token.
  2. After verifying the authorization code, Snowflake provides an access token to Tinace for retrieving the required datasets.
  3. Tinace sends the access token to the Snowflake resource server.
  4. Snowflake resource server accepts the valid access token and creates a user session for Tinace to access the resources.

Since Tinace is a confidential client, the authorization process is a one-time setup, and it need not be repeated each time Tinace tries to read data from Snowflake. 

How to refresh the access token?

The lifetime of each access token is ten minutes, and Tinace automatically renews the token to gain uninterrupted access. The refresh token can be re-authorized once every 90 days. Tinace reminds you of the expiring token with a warning sign next to the datasource name under Data → Connect.

Reminder to re-authorize the refresh token

For more information, please refer to this official Snowflake document.

Did we help you?

Snowflake Best Practices

Contact