More Snowflake Auth Methods - #318
Conversation
Adds authMethod: oauth to the Snowflake connector alongside the existing password and rsa methods. An OAuth access token is supplied via token_ref (env: or file: reference) or a literal token field, and is passed to the Snowflake SDK as authenticator: OAUTH. username is optional for OAuth since the token carries identity, but is accepted when the account requires it. Docs and five new config-resolution tests included. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extends the Snowflake connector with two additional authentication paths: - `authMethod: pat` — programmatic access token via PROGRAMMATIC_ACCESS_TOKEN authenticator, suitable for headless and CI environments - `authMethod: externalbrowser` — SSO browser popup via EXTERNALBROWSER authenticator, username now optional so IDP resolves identity Username is now only required for password and RSA auth; oauth, pat, and externalbrowser all treat it as optional. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@mattsenicksigma is attempting to deploy a commit to the Kaelio Team on Vercel. A member of the Team first needs to authorize it. |
|
More Human Comment Basically just providing more ways to provide Snowflake Auth. I don't have access to privileges in an instance to generate a PAT, so that one will need a quick manual test. I'm pretty sure that Snowflake is deprecating password auth as well, so will help users who are on password auth migrate. |
|
Thanks @mattsenicksigma ! We had a user request this recently so this is timely |
|
@Daniel-Wiszowaty feel free to test this out |
|
made some updates here, mainly:
|
|
@andreybavt lmk if anything further needed on this one, hoping to attach snowflake to a ktx instance I am playing around with |
3 participants
Summary
Adds three new authentication methods to the Snowflake connector alongside the existing password and RSA key pair paths:
authMethod: oauth) — accepts a short-lived OAuth bearer token viatoken_ref: env:VARortoken:literal. Username is optional; the token carries identity. Usesauthenticator: 'OAUTH'in the Snowflake SDK.authMethod: pat) — accepts a Snowflake-issued long-lived PAT viatoken_ref. Suitable for headless and CI environments where browser interaction is not available. Usesauthenticator: 'PROGRAMMATIC_ACCESS_TOKEN'.authMethod: externalbrowser) — opens the system browser for SAML/SSO login. Username is optional so the IDP resolves identity without a login hint. Usesauthenticator: 'EXTERNALBROWSER'.Username validation is tightened: it is now only required for
passwordandrsaauth. The three new methods treatusernameas optional.token_reffollows the sameenv:VAR/file:/pathreference syntax used by other secret fields throughout ktx.Docs updated in
docs-site/content/docs/integrations/primary-sources.mdxto cover all five auth methods with examples.Test plan
authMethod: externalbrowsertested interactively against a live Snowflake account viaktx connection testauthMethod: patrequires generating a PAT from the Snowflake account settings page, then verifyingktx connection testsucceeds withtoken_ref: env:SNOWFLAKE_PATauthMethod: oauthrequires a valid short-lived OAuth bearer token; verifyktx connection testaccepts it viatoken_ref🤖 Generated with Claude Code