COF-C03 Question 154
Single answerOAuthA company wants a custom web application to access Snowflake on behalf of employees using the company's external identity provider. Security policy requires that users authenticate with the identity provider, and the application must pass an OAuth access token to Snowflake instead of storing Snowflake passwords. The Snowflake administrator needs to configure Snowflake so it trusts tokens issued by the external identity provider for this application. Which Snowflake configuration should be implemented?
- A
Create a SECURITY INTEGRATION of type EXTERNAL_OAUTH that defines the external issuer, audience, and user mapping for tokens from the identity provider.
- B
Create a NETWORK POLICY that allows only the identity provider IP addresses so Snowflake can validate OAuth tokens.
- C
Enable key pair authentication for all users and have the application exchange the private key for an OAuth token during login.
- D
Create a SECURITY INTEGRATION of type OAUTH for the external identity provider and configure it with the provider's client secret.
Show answer and explanation
Correct answer: A
Explanation
When a custom application authenticates users with an external identity provider and then sends an access token to Snowflake, Snowflake must be configured to trust that external token. The correct mechanism is a SECURITY INTEGRATION with TYPE = EXTERNAL_OAUTH. In practice, administrators configure values such as the external OAuth issuer, supported audiences, JWKS or token validation settings, and user/role mapping claims so Snowflake can validate the token and determine the Snowflake user context. This aligns with Snowflake documentation for External OAuth, which is specifically designed for integrating Snowflake with third-party authorization servers such as enterprise identity providers. By contrast, NETWORK POLICY controls source IP access, key pair authentication is a different login mechanism, and a standard OAUTH security integration is used when Snowflake itself acts as the OAuth authorization server.
- A. Correct.
Correct. To allow Snowflake to accept OAuth access tokens issued by an external identity provider, the administrator configures an EXTERNAL_OAUTH security integration. This integration defines properties such as the token issuer, allowed audiences, and how token claims map to Snowflake users and roles. This is the standard Snowflake approach when a third-party IdP issues the token and the client application presents that token to Snowflake.
- B. Incorrect.
Incorrect. A network policy restricts which client IP addresses can connect to Snowflake, but it does not establish trust for OAuth tokens or validate token issuer and audience claims. Someone might choose this option because it sounds security-related, but it addresses network access control, not OAuth federation.
- C. Incorrect.
Incorrect. Key pair authentication is a separate authentication mechanism for Snowflake users and service access. It does not involve Snowflake trusting externally issued OAuth access tokens from an identity provider. This option reflects a common confusion between authentication methods supported by Snowflake and OAuth token-based federation.
- D. Incorrect.
Incorrect. The OAUTH security integration type in Snowflake is used for Snowflake as the authorization server, not for trusting tokens issued by an external identity provider. For third-party-issued tokens, EXTERNAL_OAUTH is required. The mention of a client secret is another clue that this option is describing application registration concepts rather than the correct Snowflake trust configuration.