Setup OAuth for Snowflake Output

Connect to Snowflake with OAuth

Note

You can’t use a custom authorization provider.

This OAuth architecture is value only for Snowflake virtual private connections.

These high-level instructions help you navigate the steps involved. Remember to contact your Network Security or IT department for help with configuration consistent with your organization’s security requirements.

1. Configure Snowflake and your selected external authorization server. Here’s Snowflake's help, with detailed instructions for connecting to services like Okta.
2. With the authorization server is configured, follow the steps under Define an Authentication Provider in Salesforce from Configure an Authentication Provider Using OpenID.
   • If you’re using Okta, here are Okta's instructions for adding their service to Salesforce.
3. With the authentication provider added to Salesforce, define a named credential in Salesforce. Select the OAuth 2.0 authentication protocol and Named Principal identity type. Use of External Credentials is not supported.
4. Add the Snowflake connection. For Authentication Type setting, enter OAuth.

Note OAuth 2.0 is the industry-standard protocol for authorization, however we’re unable to test every possible combination of services. Log a case with Salesforce Support if your service can’t connect with the Authentication Provider system.

Create an External Auth Identity Provider

1. From Setup, in the Quick Find box, enter Named, and then select Named Credentials.
2. On the External Auth Identity Provider tab, click New.
   
3. Enter a label and name.
4. For Authentication Protocol, select OAuth 2.0.
5. For Authentication Flow Type, select Authorization Code (Browser Flow).
6. Use the client ID and client secret values from your Snowflake OAuth app
7. For the authorize and token endpoint URLs, provide the values from the Snowflake OAuth Metadata URI details found in the Security APIs section. There should be a separate URL value for each.
8. Save your external auth identity provider.
9. Open your new external auth identity provider and copy the Callback URL value.
   
10. Use the callback URL value in your Snowflake OAauth application, adding it to the Login values as the callback URL value for a sign-in redirect URI.