COF-C03 Question 243
Single answerSnowflake driversA company is building a Java-based internal application that connects to Snowflake through the Snowflake JDBC driver. Security policy requires all users to authenticate with single sign-on (SSO) through the company identity provider, and the developers want to avoid embedding passwords in the application configuration. During testing, the team confirms users can launch a browser and complete login from their desktops. Which JDBC connection approach best meets these requirements?
- A
Configure the JDBC connection to use the externalbrowser authenticator so users sign in through the identity provider in a web browser
- B
Store each user's Snowflake password in an encrypted local file and use the default username/password JDBC connection
- C
Use key-pair authentication for all end users so each employee logs in interactively with their private key instead of SSO
- D
Configure the JDBC driver to authenticate with USE ROLE and USE WAREHOUSE statements after connecting without credentials
Show answer and explanation
Correct answer: A
Explanation
For Snowflake drivers, the correct solution depends on both the application type and the required authentication model. In this scenario, the application is Java-based and users can interactively complete sign-in on their desktops. The Snowflake JDBC driver supports federated authentication with the externalbrowser authenticator, which is designed for browser-based SSO through an identity provider. This avoids hardcoding or storing user passwords in application configuration while aligning with enterprise SSO policies. By contrast, username/password authentication still requires credential management, key-pair authentication is better suited to service accounts or non-interactive workloads rather than interactive SSO for end users, and SQL session commands such as USE ROLE do not perform authentication. This aligns with Snowflake documentation for JDBC driver authentication methods and best practices for federated SSO.
- A. Correct.
Correct. The Snowflake JDBC driver supports federated authentication using the externalbrowser authenticator. This launches a browser-based login flow through the configured identity provider, allowing users to authenticate with SSO without embedding Snowflake passwords in the application. This is a common approach for desktop users who can complete an interactive browser sign-in.
- B. Incorrect.
Incorrect. Although encrypting stored passwords may reduce exposure, this approach still relies on storing and managing user passwords in the application environment, which does not satisfy the requirement to avoid embedded passwords when SSO is mandated. It also bypasses the intended federated authentication flow.
- C. Incorrect.
Incorrect. Key-pair authentication is supported by Snowflake drivers, but it is primarily used for programmatic authentication by service users rather than interactive end-user SSO. It does not meet the stated requirement that all users authenticate through the company identity provider using SSO.
- D. Incorrect.
Incorrect. USE ROLE and USE WAREHOUSE are SQL commands that set session context after a successful connection is established. They are not authentication mechanisms and cannot replace valid JDBC authentication credentials or an SSO flow.