ADO.NET Provider for Snowflake

Build 26.0.9655

Establishing a Connection

Connecting to Snowflake

Before authenticating, set the following properties to define your Snowflake connection:

  • URL: Your Snowflake URL, such as https://orgname-myaccount.snowflakecomputing.com.
    • If using a Legacy URL: https://myaccount.region.snowflakecomputing.com.
    • To find your URL:
      1. Click on your name in the lower left-hand corner of your Snowflake UI.
      2. Hover over your Account ID.
      3. Click the Copy Account URL icon to copy your account URL.
  • Database (optional): Restrict the tables and views exposed by the provider to those from a specific Snowflake database.
  • Schema (optional): Restrict the tables and views exposed by the provider to those from a specific Snowflake database schema.

Authenticating to Snowflake

The provider supports OAuth authentication by default and also provides several options for federated identity providers and key-based login.

To specify the authentication method you want to use, set the AuthScheme property.

OAuth

To authenticate with OAuth, set the AuthScheme to OAuth.

To complete OAuth authentication, see Creating a Custom OAuth App. Then configure the following connection properties:

  • OAuthClientId: Set to the Client ID of your registered OAuth application.
  • OAuthClientSecret: Set to the Client Secret for the registered application.
  • CallbackURL: Set to the redirect URI configured in your OAuth app settings.

The provider also supports additional OAuth-based authentication schemes for specific Identity Providers. These schemes extend the standard OAuth configuration and support either browser-based login or headless authentication. Depending on your identity provider, the following additional OAuth-based authentication schemes are supported. Set the AuthScheme to one of the following values and configure the required properties.

  • AuthScheme=OAuthAzureAD: Performs non-browser OAuth authentication using Entra ID. Snowflake's security integration type is external_oauth.
    • OAuthClientId: Set to the Entra ID application's Client ID.
    • OAuthClientSecret: Set to the Entra ID application's Client Secret.
    • CallbackURL: Set to the Redirect URI configured in your Entra ID app.
    • AzureTenant: Set to your Entra ID Tenant ID.
    • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
  • AuthScheme=OAuthClientAzureAD: Uses the client credentials grant flow with Entra ID. No browser required.
  • AuthScheme=OAuthOkta: Performs OAuth authentication with Okta as the Identity Provider.
  • AuthScheme=OAuthClientOkta: Uses the client credentials grant flow with Okta. No browser required.
  • AuthScheme=OAuthOther: Performs OAuth authentication using a third-party Identity Provider, such as PingFederate.
  • AuthScheme=OAuthClientOther: Uses the client credentials grant flow with a third-party Identity Provider such as PingFederate. No browser required.
  • AuthScheme=OAuthJWT: Performs OAuth authentication using a signed JWT and a certificate. This scheme is typically used with Entra ID and other IdPs that support JWT-based assertion.
    • OAuthJWTCert: Path to the certificate file (.pfx or .pem) used to sign the JWT.
    • OAuthJWTCertType: The format of the certificate file (PEM, PFX).
    • OAuthClientId: The Client ID for your OAuth application.
    • OAuthClientSecret: (Optional) The Client Secret, if required by your IdP.
    • AzureTenant: (If using Entra ID) Set this to your Entra ID Tenant ID.
    • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
  • AuthScheme=AzureMSI: Performs OAuth authentication using Azure Managed Identity (MSI). This method is ideal for applications running in Azure-hosted environments such as Azure App Services and virtual machines.
    • AzureResource: Set to the target resource ID as required by your Snowflake security integration.
    • OAuthClientId: (optional) The Client ID of your user-assigned managed identity.
    • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.

Configuring External OAuth for Entra ID

The OAuthAzureAD and OAuthClientAzureAD schemes use Snowflake's External OAuth, with Microsoft Entra ID as the Identity Provider (IdP). Unlike a custom OAuth app (see Creating a Custom OAuth App), where Snowflake itself issues the access tokens, External OAuth configures Snowflake to trust and validate tokens issued by Entra ID. Before you connect, an account administrator must register an Entra ID application and create an External OAuth security integration in Snowflake.

Complete the following steps:

  1. Register an Entra ID application. If you do not already have one, create an Entra ID application that exposes Snowflake as an OAuth resource and registers an OAuth client. For the full procedure, see Configure Microsoft Entra ID for External OAuth in the Snowflake documentation. Note the application's Client ID, a Client Secret, and your Tenant ID. You supply these values in OAuthClientId, OAuthClientSecret, and AzureTenant.
  2. Obtain the issuer URL. In the application's Endpoints, open the Federation metadata document and copy the entityID value. This value is the issuer used in the security integration and resembles https://sts.windows.net/your-tenant-id/. Include the trailing slash.
  3. Map Snowflake users to Entra ID identities. The required mapping depends on the grant type:
    • OAuthAzureAD uses the authorization code grant, so the access token represents the signed-in user. Ensure that a Snowflake user exists whose login name matches the user's Entra ID username.
    • OAuthClientAzureAD uses the client credentials grant, so the access token represents the application itself. Create a Snowflake user whose login name matches the Entra ID application's Client ID.
  4. Create the security integration. Only account administrators (users with the ACCOUNTADMIN role) or a role with the global CREATE INTEGRATION privilege can run this command. Set external_oauth_issuer to the issuer URL from the previous step. The value is case-sensitive and must match exactly, including the trailing slash. For example: 
    create security integration my_azure_integration
    type = external_oauth
    enabled = true
    external_oauth_type = azure
    external_oauth_issuer = 'https://sts.windows.net/your-tenant-id/'
    external_oauth_token_user_mapping_claim = 'upn'
    external_oauth_snowflake_user_mapping_attribute = 'login_name';

After you create the security integration, set InitiateOAuth to GETANDREFRESH and connect. The following is an example connection string for the OAuthAzureAD authorization code grant: 

AuthScheme=OAuthAzureAD;Url=https://myaccount.region.snowflakecomputing.com;InitiateOAuth=GETANDREFRESH;OAuthClientId=MyClientId;OAuthClientSecret=MyClientSecret;AzureTenant=MyTenantId;

The following is an example connection string for the OAuthClientAzureAD client credentials grant: 

AuthScheme=OAuthClientAzureAD;Url=https://myaccount.region.snowflakecomputing.com;InitiateOAuth=GETANDREFRESH;OAuthClientId=MyClientId;OAuthClientSecret=MyClientSecret;AzureTenant=MyTenantId;

Desktop Apps

This section describes desktop authentication using the credentials for your custom OAuth app. See Creating a Custom OAuth App for more information.

Get an OAuth Access Token

After setting the following, you are ready to connect:

  • OAuthClientId: Set to the Client ID in your OAuth Integration settings.
  • OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.
  • CallbackURL: Set to the Redirect URL in your OAuth Integration settings.
  • InitiateOAuth: Set to GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.
When you connect, the provider opens the OAuth endpoint in your default browser. Log in and grant permissions to the application. The provider then completes the following OAuth process:
  1. Extracts the access token from the callback URL and authenticates requests.
  2. Obtains a new access token when the old one expires.
  3. Saves OAuth values in OAuthSettingsLocation to be persisted across connections.

Manually Get an OAuth Access Token

Set the following connection properties to obtain the OAuthAccessToken:

You can then call stored procedures to complete the OAuth exchange:

  1. Call the GetOAuthAuthorizationUrl stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. The stored procedure returns the URL to the OAuth endpoint and the PKCEVerifier.
  2. Open the URL, log in, and authorize the application. You are redirected back to the callback URL.
  3. Call the GetOAuthAccessToken stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. Set the PKCEVerifier input to the value of the PKCEVerifier retrieved from the first step.

Headless Machines

To configure the driver to use OAuth with a user account on a headless machine, you need to authenticate on another device that has an internet browser.

  1. Choose one of these two options:

    • Option 1: Obtain the OAuthVerifier value as described in "Obtain and Exchange a Verifier Code" below.
    • Option 2: Install the provider on another machine and transfer the OAuth authentication values after you authenticate through the usual browser-based flow, as described in "Transfer OAuth Settings" below.

  2. Then configure the provider to automatically refresh the access token from the headless machine.

Option 1: Obtain and Exchange a Verifier Code

To obtain a verifier code, you must authenticate at the OAuth authorization URL.

See Creating a Custom OAuth App for a procedure. This section describes the procedure to authenticate and connect to data.

To obtain the verifier code, set the following properties on the headless machine:

Next, authenticate from another machine and obtain the OAuthVerifier connection property:

  1. Call the GetOAuthAuthorizationUrl stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. The stored procedure returns the URL to the OAuth endpoint and the PKCEVerifier.
  2. Open the returned URL in a browser. Log in and grant permissions to the provider. You are then redirected to the callback URL, which contains the verifier code.
  3. Save the value of the Verifier and the value of the PKCEVerifier. You need to set the value of the Verifier in the OAuthVerifier connection property and set the value of the PKCEVerifier in the PKCEVerifier connection property.

Finally, on the headless machine, set the following connection properties to obtain the OAuth authentication values:

Connect to Data

After the OAuth settings file is generated, set the following properties to connect to data:

  • OAuthSettingsLocation: Set to the location containing the encrypted OAuth authentication values. Make sure this location gives read and write permissions to the provider to enable the automatic refreshing of the access token.
  • InitiateOAuth: Set to REFRESH.

Option 2: Transfer OAuth Settings

To install the provider on another machine, authenticate, and then transfer the resulting OAuth values:

  1. On a second machine, install the provider and connect with the following properties set:
  2. Test the connection to authenticate. The resulting authentication values are written, encrypted, to the location specified by OAuthSettingsLocation. Once you have successfully tested the connection, copy the OAuth settings file to your headless machine. On the headless machine, set the following connection properties to connect to data:
    • InitiateOAuth: Set to REFRESH.
    • OAuthSettingsLocation: Set to the location of your OAuth settings file. Make sure this location gives read and write permissions to the provider to enable the automatic refreshing of the access token.

Passwords

Set User and Password to a Snowflake user and set AuthScheme to PASSWORD.

Note: Starting with accounts created using Snowflake's bundle 2024_08 (October 2024), password-based authentication is no longer supported due to security concerns. Instead, use alternative authentication methods such as OAuth or Private Key authentication.

Private Key

The provider allows you to authenticate using key pair authentication by creating a secure token with the private key defined for your user account. To connect with this method, set AuthScheme to PrivateKey and set the following values:

  • User: The user account to authenticate as.
  • PrivateKey: The private key used for the user such as the path to the .pem file containing the private key.
  • PrivateKeyType: The type of key store containing the private key such as PEMKEY_FILE, PFXFILE, etc.
  • PrivateKeyPassword: The password for the specified private key.

Okta

Set the AuthScheme to OKTA. The following connection properties are used to connect to Okta:

  • User: Set this to the Okta user.
  • Password: Set this to the Okta password for the user.
  • MFAPasscode (optional): Set this to the OTP code that was sent to your device. This property should be used only when the MFA is required for OKTA sign on.
The following SSOProperties are needed to authenticate to Okta:

  • Domain: Set this to the OKTA org domain name.
  • MFAType (optional): Set this to the multi-factor type. This property should be used only when the MFA is required for OKTA sign on. This property accepts one of the following values:
    • OKTAVerify
    • Email
    • SMS
  • APIToken (optional): Set this to the API Token that the customer created from the Okta organization. You should specify this when authenticating a user via a trusted application or proxy that overrides OKTA client request context. In most contexts, it is not needed.

The following is an example connection string: 

AuthScheme=OKTA;User=username;Password=password;Url='https://myaccount.region.snowflakecomputing.com';Warehouse=My_warehouse;SSO Properties='Domain=https://cdata-okta.okta.com';

The following is an example connection string for OKTA MFA: 

AuthScheme=OKTA;User=username;Password=password;MFAPasscode=8111461;Url='https://myaccount.region.snowflakecomputing.com';Warehouse=My_warehouse;SSO Properties='Domain=https://cdata-okta.okta.com;MFAType=OktaVerify;';

PingFederate

Set the AuthScheme to PingFederate. Set the following connection properties to connect to PingFederate:

  • User: Set this to your PingFederate user. You must also add the user to PingFederate Data Stores. When connecting, your browser opens allowing you to login to PingFederate to complete the authentication.
  • Password: Set this to the user password.
  • ProofKey (optional): You must specify this if you want to connect without using a browser. In a browser setting, this value is autogenerated.
  • ExternalToken (optional): Required if you want to connect without a browser. In a browser setting, this value is autogenerated.
The following is an example connection string for PingFederate (assuming that Active Directory is used as a Data Store): 
AuthScheme=PingFederate;Url=https://myaccount.region.snowflakecomputing.com;User=myuser@mydomain;Account=myaccount;Warehouse=mywarehouse;

Using a Proof Key and External Token

Setting the AuthScheme to PingFederate involves the use of a Proof Key and an External Token. If you choose to complete authentication via an internet browser, these values are autogenerated and automatically included in the connection string that you use during the Snowflake log in process.

If you choose to connect by means other than via a browser, you must specify values for ProofKey and ExternalToken. In this case, follow the steps below to authenticate:

  1. Create a local web server with a specified port, such as 8080.
  2. Call the GetSSOAuthorizationURL stored procedure using your specified port. This procedure returns a login SSO URL.
  3. Copy and paste the returned URL into a browser.
  4. In the page that opens, enter your username and password.
  5. After you log in, a callback URL is generated and sent to your local web server instance. This callback URL is in a specialized format. You need to write your own code to extract the External Token from the callback URL.

SAML Providers

The provider has generic support for SAML-based identity providers, such as OneLogin.

Set the AuthScheme to ExternalBrowser.

OneLogin

Set User to the Snowflake user you want to authenticate.

When you attempt a connection, the SAML provider launches a login prompt in your default web browser.

Provide the credentials associated with your SAML provider to authenticate to Snowflake.

Configuring Access Control

If the authenticating user maps to a system-defined role, specify it in the RoleName property.

Copyright (c) 2026 CData Software, Inc. - All rights reserved.
Build 26.0.9655