ADA-C01 Question 70
Single answerEstablish federated authentication and Single Sign-on (SSO) to SnowflakeA company is integrating Snowflake with its corporate identity provider (IdP) for SAML 2.0 federated authentication. The security team requires users to authenticate through the IdP portal and does not want Snowflake usernames to vary by login method. During testing, users can launch Snowflake from the IdP, but some receive errors because the SAML assertion NameID does not match the Snowflake login name. The administrator wants a solution that supports consistent user identity mapping and a proper SSO experience. What should the administrator do?
- A
Configure Snowflake to use the SAML2_SNOWFLAKE_USER_MAPPING_ATTRIBUTE parameter so Snowflake maps the SAML assertion attribute to the Snowflake LOGIN_NAME, and ensure users access Snowflake through the IdP-initiated SSO flow.
- B
Enable SCIM provisioning only, because SCIM automatically resolves SAML NameID mismatches during authentication and removes the need for SSO-specific user mapping.
- C
Change each Snowflake USER NAME value to match the SAML NameID exactly, because Snowflake federated authentication can map only to the USER NAME and not to LOGIN_NAME.
- D
Require users to authenticate with key pair authentication first, then redirect them to the IdP so Snowflake can associate the SAML assertion with the correct session.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure SAML user mapping correctly in Snowflake so the SAML assertion maps to the intended Snowflake user attribute, typically LOGIN_NAME, rather than forcing a fragile one-to-one dependency on NameID matching the Snowflake user object name. In real deployments, organizations often want the IdP to remain the source of authentication while Snowflake maintains stable user identities and access control. Snowflake supports SAML 2.0 federated authentication and administrator-configurable user mapping for this purpose. IdP-initiated SSO is a common access pattern when users launch Snowflake from a corporate portal. SCIM is complementary for provisioning but does not handle authentication-time assertion mapping. Relevant Snowflake documentation includes the sections on federated authentication, SAML 2.0 integration, and SAML user mapping parameters for establishing SSO with an external IdP.
- A. Correct.
Correct. In SAML 2.0 federated authentication, Snowflake can use a SAML attribute for user mapping rather than relying strictly on the SAML NameID matching the Snowflake username. Using the appropriate Snowflake SAML user-mapping parameter allows the IdP assertion to map consistently to a Snowflake user attribute such as LOGIN_NAME. This is the right approach when the organization wants consistent identity mapping without renaming Snowflake users. It also aligns with a standard SSO flow where users initiate access from the corporate IdP.
- B. Incorrect.
Incorrect. SCIM provisioning is used to automate lifecycle management such as creating, updating, and disabling users and groups in Snowflake. It does not replace SAML authentication processing and does not automatically resolve SAML assertion mapping issues during login. A candidate might choose this because SCIM is often deployed with SSO, but it solves provisioning, not runtime authentication mapping.
- C. Incorrect.
Incorrect. This reflects a common misconception. Snowflake does not require administrators to rename every user object so that USER NAME exactly equals the SAML NameID. Snowflake supports configurable SAML user mapping, commonly to LOGIN_NAME or another supported user attribute depending on configuration. Renaming users is operationally disruptive and unnecessary when proper SAML mapping is available.
- D. Incorrect.
Incorrect. Key pair authentication and SAML federated authentication are separate authentication methods. Users do not authenticate with one method in order to establish the identity for another. This option incorrectly combines unrelated mechanisms and would not solve a SAML NameID-to-user mapping problem.