Establishing a Connection
You can create and manage connections with the Data Explorer and the FireDAC Connection Editor wizards. See Connection Definitions for more information on creating connections from code and creating persistent, private, or temporary connections.
Connecting to Snowflake
In addition to providing authentication (see below) set the following properties to connect to a Snowflake database:
- Url: Both AWS and Azure instances are supported. For example:
- AWS: https://myaccount.region.snowflakecomputing.com
- Azure: https://myaccount.region.azure.snowflakecomputing.com
Account is only required if your Url does not conform to the usual syntax containing the account name at the beginning. Snowflake provides the Account name needed in this case.
Optionally, you can set Database and Schema to restrict the tables and views returned by the component.
GCP Instances
To establish a connection to GCP instances, specify this URL:URL: https://myaccount.gcp.snowflakecomputing.comThe following is an example connection string for working with GCP instances:
jdbc:snowflake:AuthScheme=Basic;url=https://myaccount.gcp.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;
Authenticating to Snowflake
The component supports Snowflake user authentication, federated authentication, and SSL client authentication. To authenticate, set User and Password, and select the authentication method in the AuthScheme property.
Passwords
Set User and Password to a Snowflake user and set AuthScheme to PASSWORD.
Key Pairs
The component allows you to authenticate using key pair authentication by creating a secure token with the private key defined for your user account. To connect with this method, set AuthScheme to PRIVATEKEY and set the following values:
- User: The user account to authenticate as.
- PrivateKey: The private key used for the user such as the path to the .pem file containing the private key.
- PrivateKeyType: The type of key store containing the private key such as PEMKEY_FILE, PFXFILE, etc.
- PrivateKeyPassword: The password for the specified private key.
Okta
Set the AuthScheme to OKTA. The following connection properties are used to connect to Okta:
- User: Set this to the Okta user.
- Password: Set this to Okta password for the user.
- MFAPasscode (optional): Set this to the OTP code that was sent to your device. This property should be used only when the MFA is required for OKTA sign on.
- Domain: Set this to the OKTA org domain name.
- MFAType (optional): Set this to the multi-factor type. This property should be used only when the MFA is required for OKTA sign on. This property accepts one of the following values:
- OKTAVerify
- SMS
- APIToken (optional): Set this to the API Token that the customer created from the Okta organization. You should specify this when authenticating a user via a trusted application or proxy that overrides OKTA client request context. In most contexts, it is not needed.
The following is an example connection string:
AuthScheme=OKTA;User=username;Password=password;Url='https://myaccount.region.snowflakecomputing.com';Warehouse=My_warehouse;SSO Properties='Domain=https://cdata-okta.okta.com';
The following is an example connection string for OKTA MFA:
AuthScheme=OKTA;User=username;Password=password;MFAPasscode=8111461;Url='https://myaccount.region.snowflakecomputing.com';Warehouse=My_warehouse;SSO Properties='Domain=https://cdata-okta.okta.com;MFAType=OktaVerify;';
AzureAD
Set the AuthScheme to AzureAD and set User to your AD user. When connecting, your browser opens, allowing you to login to Azure AD to complete the authentication. The following is an example connection string for AzureAD:AuthScheme=AzureAD;Url=https://myaccount.region.snowflakecomputing.com;[email protected];
PingFederate
Set the AuthScheme to PingFederate. Set the following connection properties to connect to PingFederate:- User: Set this to your PingFederate user. You must also add the user to PingFederate Data Stores. When connecting, your browser opens allowing you to login to PingFederate to complete the authentication.
- Password: Set this to the user password.
- ProofKey (optional): You must specify this if you want to connect without using a browser. In a browser setting, this value is autogenerated.
- ExternalToken (optional): Required if you want to connect without a browser. In a browser setting, this value is autogenerated.
AuthScheme=PingFederate;Url=https://myaccount.region.snowflakecomputing.com;User=myuser@mydomain;Account=myaccount;Warehouse=mywarehouse;
Using a Proof Key and External Token
Setting the AuthScheme to AzureAD or PingFederate involves the use of a Proof Key and an External Token. If you choose to complete authentication via an internet browser, these values are autogenerated and automatically included in the connection string that you use during the Snowflake log in process.If you choose to connect by means other than via a browser, you must specify values for ProofKey and ExternalToken. In this case, follow the steps below to authenticate:
- Create a local web server with a specified port, such as 8080.
- Call the GetSSOAuthorizationURL stored procedure using your specified port. This procedure returns a login SSO URL.
- Copy and paste the returned URL into a browser.
- In the page that opens, enter your username and password.
- After you log in, a callback URL is generated and sent to your local web server instance. This callback URL is in a specialized format. You need to write your own code to extract the External Token from the callback URL.
OAuth
To authenticate with OAuth, set the AuthScheme to OAuth. You can authenticate by Creating a Custom OAuth App to obtain the OAuthClientId, OAuthClientSecret, and CallbackURL connection properties.
NOTE: There is an additional connection property called OAuthAuthenticator. Its default value is Azure, but it can be set to None or OKTA. This property determines which authenticator that the OAuth application requests from Snowflake.
There is a distinction between setting the AuthScheme to AzureAD and setting the AuthScheme to OAuth and OAuthAuthenticator to Azure:
- AuthScheme=AzureAD: is a form SSO authentication which requires a browser, and from Snowflake's side, the security integration type is SAML2.
- AuthScheme=OAuth with OAuthAuthenticator=Azure: is a form of OAuth that does not require a browser. From Snowflake's side, the security integration type is "external_oauth".
Desktop Apps
This section describes desktop authentication using the credentials for your custom OAuth app. See Creating a Custom OAuth App for more information.Get an OAuth Access Token
After setting the following, you are ready to connect:
- OAuthClientId: Set to the Client ID in your OAuth Integration settings.
- OAuthClientSecret: Set to the Client Secret in OAuth your Integration settings.
- CallbackURL: Set to the Redirect URL in your OAuth Integration settings.
- InitiateOAuth: Set to GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.
- Extracts the access token from the callback URL and authenticates requests.
- Obtains a new access token when the old one expires.
- Saves OAuth values in OAuthSettingsLocation to be persisted across connections.
Manually Get an OAuth Access Token
Set the following connection properties to obtain the OAuthAccessToken:
- InitiateOAuth: Set to OFF.
- OAuthClientId: Set to the Client ID in your OAuth Integration settings.
- OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.
You can then call stored procedures to complete the OAuth exchange:
- Call the GetOAuthAuthorizationUrl stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. The stored procedure returns the URL to the OAuth endpoint and the PKCEVerifier.
- Open the URL, log in, and authorize the application. You are redirected back to the callback URL.
- Call the GetOAuthAccessToken stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. Set the PKCEVerifier input to the value of the PKCEVerifier retrieved form the first step.
Headless Machines
To configure the driver to use OAuth with a user account on a headless machine, you need to authenticate on another device that has an internet browser.- Choose one of these two options:
- Option 1: Obtain the OAuthVerifier value as described in "Obtain and Exchange a Verifier Code" below.
- Option 2: Install the component on another machine and transfer the OAuth authentication values after you authenticate through the usual browser-based flow, as described in "Transfer OAuth Settings" below.
- Then configure the component to automatically refresh the access token from the headless machine.
Option 1: Obtain and Exchange a Verifier Code
To obtain a verifier code, you must authenticate at the OAuth authorization URL.
See Creating a Custom OAuth App for a procedure. This section describes the procedure to authenticate and connect to data.
To obtain the verifier code, set the following properties on the headless machine:
- InitiateOAuth: Set to OFF.
- OAuthClientId: Set to the Client ID in your OAuth Integration settings.
- OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.
Next, authenticate from another machine and obtain the OAuthVerifier connection property:
- Call the GetOAuthAuthorizationUrl stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. The stored procedure returns the URL to the OAuth endpoint and the PKCEVerifier.
- Open the returned URL in a browser. Log in and grant permissions to the component. You are then redirected to the callback URL, which contains the verifier code.
- Save the value of the Verifier and the value of the PKCEVerifier. You need to set the value of the Verifier in the OAuthVerifier connection property and set the value of the PKCEVerifier in the PKCEVerifier connection property.
Finally, on the headless machine, set the following connection properties to obtain the OAuth authentication values:
- OAuthClientId: Set to the Client ID in your OAuth Integration settings.
- OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.
- OAuthVerifier: Set to the verifier code.
- PKCEVerifier: Set to the PKCE verifier code.
- OAuthSettingsLocation: Set to persist the encrypted OAuth authentication values to the specified location.
- InitiateOAuth: Set to REFRESH.
Connect to Data
After the OAuth settings file is generated, set the following properties to connect to data:
- OAuthSettingsLocation: Set to the location containing the encrypted OAuth authentication values. Make sure this location gives read and write permissions to the provider to enable the automatic refreshing of the access token.
- InitiateOAuth: Set to REFRESH.
Option 2: Transfer OAuth Settings
To install the component on another machine, authenticate, and then transfer the resulting OAuth values:
- On a second machine, install the component and connect with the following properties set:
- OAuthSettingsLocation: Set to a writable location.
- InitiateOAuth: Set to GETANDREFRESH.
- OAuthClientId: Set to the Client ID in your app settings.
- OAuthClientSecret: Set to the Client Secret in your app settings.
- CallbackURL: Set to the Callback URL in your app settings.
- Test the connection to authenticate. The resulting authentication values are written, encrypted, to the location specified by OAuthSettingsLocation. Once you have successfully tested the connection, copy the OAuth settings file to your headless machine. On the headless machine, set the following connection properties to connect to data:
- InitiateOAuth: Set to REFRESH.
- OAuthSettingsLocation: Set to the location of your OAuth settings file. Make sure this location gives read and write permissions to the component to enable the automatic refreshing of the access token.
SAML Providers
The component has generic support for SAML-based identity providers, such as OneLogin.
Set the AuthScheme to ExternalBrowser.
OneLogin
Set User to the Snowflake user you want to authenticate.
When you attempt a connection, the SAML provider will launch a login prompt in your default web browser.
Provide the credentials associated with your SAML provider to authenticate to Snowflake.
Configuring Access Control
If the authenticating user maps to a system-defined role, specify it in the RoleName property.
Using the FireDAC Connection Editor
Complete the following steps to use the FireDAC Connection Editor to assign a Snowflake connection to a TFDConnection object:
- Open a project and drop a TFDPhysCDataSnowflakeDriverLink from the Tool Palette onto the Form Designer.
- Drop a TFDConnection object onto the Form Designer.
- Double-click the TFDConnection and select CDataSnowflake in the Driver Id menu.
- Define the necessary connection properties.
- To execute ad-hoc SQL statements based on this connection, enter SQL commands on the SQL Script tab.
- In the Form Designer, select the TFDConnection object and set the Connected property to true.
Using the Data Explorer
Complete the following steps to use the Data Explorer to define persistent connections that can be shared across applications and projects:
- Click View > Tool Windows > Data Explorer in RAD Studio and expand the FireDAC node.
- Right-click the CData Snowflake Data Source node and click Add New Connection.
- Enter a name for the connection. The FireDAC Connection Editor opens.
Working with Persistent Connections
The connections you define in the Data Explorer can be assigned to a TFDConnection object by specifying the connection name in the TFDConnection object's ConnectionDefName property.
Browsing Data and Metadata
The Data Explorer also provides options for browsing Snowflake objects at design time:
- Expand the CData Snowflake Data Source node in the Data Explorer to view the defined connections.
- Expand a connection node to find the database objects available for a connection.
- Drill down to a database object to find metadata such as primary keys and foreign keys.
- To display data, double-click a table or view or right-click and click View.