COF-C03 Question 153
Single answerSingle Sign-on (SSO)A company has integrated Snowflake with its corporate identity provider using SAML 2.0 single sign-on (SSO). Employees can successfully access Snowflake through the Snowsight login page, but a group of analysts using custom scripts with the SnowSQL client report that authentication fails when they try to connect with only their username and password. The security team wants authentication to continue using the corporate identity provider and does not want Snowflake-native passwords used for these users. Which action should the Snowflake administrator recommend?
- A
Configure the SnowSQL connections to use the externalbrowser authenticator so users authenticate through the SAML identity provider
- B
Reset the affected users' Snowflake passwords and have them authenticate directly with username and password in SnowSQL
- C
Create key-pair authentication for all affected users because SSO cannot be used with client tools such as SnowSQL
- D
Change the Snowflake account to use OAuth instead of SAML because SAML SSO only supports Snowsight
Show answer and explanation
Correct answer: A
Explanation
In Snowflake, federated authentication with a SAML 2.0 identity provider can be used not only for browser access but also with client tools. For SnowSQL, the standard approach is to specify the externalbrowser authenticator so the user completes sign-in through the browser with the corporate IdP. This preserves centralized identity and access policies such as MFA and password controls. Using Snowflake-native passwords would undermine the stated security requirement, and key-pair authentication is better suited to non-interactive workloads rather than end-user SSO. Snowflake documentation on federated authentication and SnowSQL authenticators describes use of SAML SSO with browser-based login flows for supported clients.
- A. Correct.
Correct. For federated authentication with SAML 2.0 in Snowflake, client tools such as SnowSQL can use the externalbrowser authenticator. This launches a browser-based login flow against the configured identity provider and allows users to authenticate with corporate SSO rather than Snowflake-native passwords. This matches the requirement to keep authentication with the corporate IdP.
- B. Incorrect.
Incorrect. Resetting Snowflake passwords would bypass the company's requirement to continue authenticating through the corporate identity provider. While username/password authentication can work if Snowflake passwords are enabled, it is not the recommended solution in this scenario because the security team explicitly does not want Snowflake-native passwords used for these users.
- C. Incorrect.
Incorrect. Key-pair authentication is supported for SnowSQL and is useful for service accounts or automation, but it does not satisfy the stated requirement that users continue authenticating through the corporate identity provider. The misconception is that SSO is limited to the web UI; in reality, SnowSQL supports SSO via supported authenticators such as externalbrowser.
- D. Incorrect.
Incorrect. Snowflake supports SAML-based federated authentication beyond Snowsight. SAML SSO is not limited to the web interface, and switching the entire account to OAuth is unnecessary for this problem. OAuth is a different authentication model and is typically used for programmatic access patterns or delegated authorization, not as a replacement simply because users are on SnowSQL.