ADA-C01 Question 72
Single answerConfigure an Identity Provider (IdP) for SnowflakeA company is migrating Snowflake authentication to a corporate SAML 2.0 identity provider (IdP) so users can sign in through single sign-on from the Snowflake web interface. During testing, users are redirected to the IdP successfully and can authenticate there, but after authentication Snowflake rejects the response and the login fails. The security team confirms that the IdP is sending a signed SAML assertion. Which configuration issue in Snowflake is the most likely cause of this problem?
- A
The SECURITYADMIN role was not used to create the security integration
- B
The SAML2_X509_CERT value in the Snowflake security integration does not match the certificate used by the IdP to sign the SAML response
- C
The ACCOUNTADMIN role did not grant users a default warehouse before enabling federated authentication
- D
The network policy attached to the account does not include the IdP IP addresses
- E
The Snowflake users were not configured with RSA public keys for key-pair authentication
Show answer and explanation
Correct answer: B
Explanation
In a SAML 2.0 federated authentication setup, Snowflake relies on a SAML security integration to trust and validate assertions issued by the external IdP. One of the most critical elements is the IdP signing certificate configured in the integration through the SAML2_X509_CERT parameter. If the certificate in Snowflake does not match the certificate the IdP uses to sign the SAML assertion or response, Snowflake rejects the authentication because it cannot validate the signature. This is especially common when the IdP rotates certificates and Snowflake is not updated accordingly. Other settings such as user defaults, key-pair authentication, or the role that created the integration do not directly explain a failure that occurs specifically after successful authentication at the IdP. Snowflake documentation on federated authentication and CREATE/ALTER SECURITY INTEGRATION for SAML describes configuring issuer, SSO URL, and X.509 certificate correctly so Snowflake can validate SAML responses from the IdP.
- A. Incorrect.
Incorrect. Creating or managing a SAML security integration typically requires a sufficiently privileged administrative role, and in practice ACCOUNTADMIN is commonly used for account-level security integrations. However, if users are already being redirected to the IdP, the integration exists and is at least partially configured. The failure described occurs after authentication, which points more directly to SAML assertion validation rather than which role originally executed the DDL.
- B. Correct.
Correct. For SAML federation, Snowflake must validate the signed SAML response/assertion using the certificate configured in the security integration. If the SAML2_X509_CERT in Snowflake does not match the certificate the IdP actually used to sign the response, Snowflake cannot validate the signature and the authentication fails after the user successfully signs in at the IdP. This is a common real-world issue during certificate rotation or initial setup.
- C. Incorrect.
Incorrect. A default warehouse affects what happens after a user session is established and the user starts working, not whether the SAML authentication response can be validated. A missing default warehouse would not normally cause Snowflake to reject a SAML response immediately after IdP authentication.
- D. Incorrect.
Incorrect. Network policies can restrict where users connect to Snowflake from, but in a standard browser-based SSO flow the important connection to Snowflake is from the user's client, not from the IdP's servers in a way that requires the IdP IPs to be explicitly allowed for SAML validation. Also, the symptom described specifically indicates that Snowflake rejected the SAML response after successful IdP authentication, which is more consistent with signature or assertion configuration problems than network policy issues.
- E. Incorrect.
Incorrect. RSA public keys are used for key-pair authentication, which is a different authentication mechanism from SAML federated SSO. Not configuring RSA public keys would not cause a SAML response validation failure.