COF-C03 Question 151
Single answerFederated AuthenticationA company has integrated Snowflake with its corporate identity provider (IdP) using SAML 2.0 federated authentication for the Snowflake web interface. Security administrators want employees to use single sign-on (SSO) while also ensuring that emergency administrator access is still available if the IdP becomes unavailable. Which configuration best meets these requirements?
- A
Create at least one Snowflake user with a Snowflake-managed password and keep federated authentication enabled for the rest of the users.
- B
Disable SAML integration for all users and require key pair authentication so administrators can log in even if the IdP is unavailable.
- C
Configure all Snowflake users as federated users only, because Snowflake automatically provides local fallback authentication for ACCOUNTADMIN users.
- D
Use SCIM provisioning instead of SAML so that users can authenticate directly to Snowflake if the IdP is unavailable.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to keep SAML 2.0 federated authentication for standard user SSO while preserving at least one emergency administrative account that authenticates directly with Snowflake-managed credentials. This is a practical operational safeguard often called a break-glass account. In Snowflake, SAML federation enables SSO through an external IdP, but if the IdP is unavailable, users who rely solely on federated authentication may be unable to sign in. SCIM is related to identity lifecycle management, not authentication, and key pair authentication is mainly for client/programmatic authentication rather than browser-based SSO. This aligns with Snowflake guidance to avoid depending exclusively on the external IdP for all administrative access.
- A. Correct.
Correct. A common best practice with federated authentication is to maintain at least one break-glass administrative account that uses Snowflake-managed credentials instead of relying exclusively on the external IdP. This preserves emergency access if the SAML IdP is down or misconfigured, while regular users can still authenticate through SSO.
- B. Incorrect.
Incorrect. Key pair authentication is primarily used for programmatic access, such as SnowSQL or drivers, not as a replacement for SAML-based interactive SSO for the web interface. Disabling SAML for all users would not meet the requirement for employee SSO.
- C. Incorrect.
Incorrect. Snowflake does not automatically provide a local fallback authentication path for all federated users or specifically for ACCOUNTADMIN users when the IdP is unavailable. If every administrator depends entirely on federated authentication, an IdP outage can lock administrators out.
- D. Incorrect.
Incorrect. SCIM is used for automated provisioning and deprovisioning of users and roles, not for user authentication. Replacing SAML with SCIM would not provide SSO or a fallback login mechanism.