Snowflake Connection

Connect to Snowflake with OAuth

To use the Salesforce Data Pipelines Snowflake connector with an OAuth connection, you must configure Snowflake, Salesforce, Salesforce Data Pipelines, and an external OAuth authorization server.

Note You can’t use a custom authorization provider.

These high-level instructions help you navigate the steps involved. Remember to contact your Network Security or IT department for help with configuration consistent with your organization’s security requirements.

1. Configure Snowflake and your selected external authorization server. Here’s Snowflake's help, with detailed instructions for connecting to services, such as Okta.
2. With the authorization server is configured, follow the steps under Define an Authentication Provider in Salesforce from Configure an Authentication Provider Using OpenID Connect.
   • If you’re using Okta, here are Okta's instructions for adding their service to Salesforce.
3. With the authentication provider added to Salesforce, define a named credential in Salesforce. Select the OAuth 2.0 authentication protocol and Named Principal identity type. Use of External Credentials isn't supported.
4. Verify the OAuth flow using the steps in Snowflake testing procedures. You can also verify from the principal access in the Salesforce external credential. Click Authenticate and make sure the Authentication Status updates to Configured.
5. Add the Snowflake connection. For Authentication Type setting, enter OAuth.

Note OAuth 2.0 is the industry-standard protocol for authorization, however we’re unable to test every possible combination of services. Log a case with Salesforce Customer Support if your service can’t connect with the Authentication Provider system.

Connection Details

Generate your Snowflake private key and private key passphrase using the Snowflake Private Key documentation. If you opt to rotate your Snowflake private key manually, update the connection properties with the new key.

1. On the Data Manager Connections tab, click New Connection.
2. Click the name of the connector, and click Next.
3. Enter the connector settings.
4. To validate your settings and attempt to connect to the source, click Save & Test. If the connection fails, Salesforce Data Pipelines shows possible reasons.

All settings require a value, unless otherwise indicated.

Setting	Description
Connection Name	Identifies the connections. Use a convention that lets you easily distinguish between different connections.
Developer Name	API name for the connection. This name can’t include spaces. The API name is used in your recipes to reference data extracted through this connection. You can’t change the developer name after you create the connection.
Description	Description
Username	User name for the Snowflake account.
Password	Optional setting*. Password for your Snowflake account.
Authentication Type	The type of authentication used for this connection. Accepted values are "OAuth", "Password", or "PrivateKey". "PrivateKey” is recommended as the most secure option. If you use OAuth, enter a value in the Named Credential field. If you use Password, enter a value in the Username and Password fields. If you use PrivateKey, enter a value in the Username, Private Key, and Private Key Passphrase fields.
Named Credential	The Name field from a named credential stored in your Salesforce org.
Private Key	Optional setting*. A private key associated with your Snowflake account. Note You must use an encrypted private key and password generated with the Advanced Encryption Standard (AES). For the detailed steps, refer to Key-pair authentication and key-pair rotation in Snowflake Help. When using the openssl command to generate the encrypted key, be sure to replace des3 with aes256 to ensure advanced encryption is used.
Private Key Passphrase	Optional setting*. The passphrase associated with your specified private key.
Account	Name of your Snowflake account. The account name is the first segment in the domain in your Snowflake URL. For example, 123abc is your account name in https://123abc.snowflakecomputing.com.
Warehouse	Snowflake warehouse name. This setting is case-sensitive, so enter the value exactly as it appears in Snowflake.
Role	Optional setting. Snowflake role assigned to the user that you’re using to connect.
Additional JDBC URL Parameters	Optional setting. One or more JDBC connection parameters. Enter in the format parameter1=value;parameter2=value;parameter3=value For example: user=joates;warehouse=mywh;db=mydb&schema=public
Database	Snowflake database name. This setting is case-sensitive, so enter the value exactly as it appears in Snowflake.
Schema	Snowflake schema name. This setting is case-sensitive, so enter the value exactly as it appears in Snowflake.

*Enter the Password or both the Private Key and Private Key Passphrase. Learn more about private keys in the Snowflake Private Key documentation.

Filter Data Synced to Salesforce Data Pipelines

Exclude unnecessary or sensitive data from syncing to Salesforce Data Pipelines with data sync filters. Filters run on the source object and speed up data sync by pulling only the data you need into Salesforce Data Pipelines. If you expect to use excluded data in the future, use a recipe filter to limit the data written to a dataset instead of a data sync filter.

1. From Data Manager, click the Connections tab.
2. Select the connection associated with the object to filter.
3. Click the name of the object to filter.
4. Click Data Sync Filter.
5. Enter the filter.
6. Click Save.

For the Snowflake connector, enter a SQL filter as described in the Snowflake WHERE documentation.

Remember these behaviors when working with the Snowflake connector.

• Connected object names must start with a letter and contain only letters, digits, or underscores. Object names can’t end with an underscore.
• Only field names with combinations of alphanumeric, dot, underscore, or dash characters are supported. If a connector includes field names that contain other characters, such as spaces or brackets, the sync fails.
• Rounding errors can occur in floating-point numbers when Snowflake performs the query that sends data to the connector. See the Snowflake help Data types for floating-point numbers for more information. If an ID is specified as a floating-point number in Snowflake, these errors can result in incorrect IDs being sent to the connector. Use the NUMBER or equivalent data type for IDs in Snowflake.
• The connector can sync up to 100 million rows or 50 GB per object, whichever limit is reached first. When using the connector, Salesforce Government Cloud org data is protected in transit with advanced encryption and can sync up to 10 million rows or 5 GB for each connected object, whichever limit is reached first.
• A Snowflake warehouse can be set to automatically resume or suspend. Review the Snowflake documentation for information about the optimal use of these features.
• The named credential must use the identity type Named Principal and have the status Authenticated.