COF-C03 Question 242
Single answerSnowflake driversA development team is building a Java-based internal application that connects directly to Snowflake through the Snowflake JDBC driver. The security team wants to reduce repeated authentication prompts for users who authenticate through the company IdP using browser-based SSO. The application will run on employee workstations and should reuse existing authenticated sessions when possible, without embedding user passwords in the application. Which configuration best meets this requirement?
- A
Configure the JDBC connection to use authenticator=externalbrowser so users authenticate with the browser-based SSO flow supported by Snowflake
- B
Configure the JDBC connection to use authenticator=snowflake and store each user's Snowflake password in the application configuration file
- C
Configure the JDBC connection to use a key pair for every end user so the browser-based SSO session can be reused automatically
- D
Configure the JDBC connection to use OAuth only, because Snowflake JDBC does not support browser-based SSO authentication
Show answer and explanation
Correct answer: A
Explanation
For Snowflake drivers, candidates should recognize which authentication methods fit interactive user access versus service-to-service access. In this scenario, the requirement is user authentication through the company IdP, with no stored passwords, from employee workstations. The Snowflake JDBC driver supports this with authenticator=externalbrowser, which initiates browser-based SSO. This is a standard pattern documented for Snowflake client connectivity and drivers. By contrast, authenticator=snowflake uses direct Snowflake username/password authentication, and key-pair authentication is better suited to non-interactive programmatic access rather than reusing browser SSO. OAuth can also be used with Snowflake in supported architectures, but it is not required here, and the claim that JDBC lacks browser-based SSO support is incorrect. For SnowPro Core, it is important to map the authentication requirement to the right driver capability and security best practice.
- A. Correct.
Correct. The Snowflake JDBC driver supports browser-based SSO using authenticator=externalbrowser. This launches the browser for authentication through the configured identity provider and is the appropriate choice when users should authenticate interactively without the application storing passwords. It aligns with a common enterprise pattern for user-based desktop applications.
- B. Incorrect.
Incorrect. Using authenticator=snowflake means authenticating directly with Snowflake credentials, not browser-based federated SSO. Storing user passwords in an application configuration file is also a poor security practice and does not satisfy the requirement to avoid embedding passwords.
- C. Incorrect.
Incorrect. Key-pair authentication is primarily used for programmatic authentication, often for service users or automation scenarios. It does not reuse a user's browser-based SSO session and is not the best fit for an employee desktop application that needs interactive SSO through the corporate IdP.
- D. Incorrect.
Incorrect. Snowflake JDBC does support browser-based SSO through externalbrowser. OAuth is supported in some scenarios, but the statement that JDBC does not support browser-based SSO is factually wrong. Choosing OAuth solely for that reason is based on an incorrect assumption.