ADA-C01 Question 95
Single answerCompare Snowflake OAuth to External OAuthA company is integrating a new internal web application with Snowflake. The security team requires that all user authentication be handled by the company’s centralized identity provider (IdP), which already issues OAuth access tokens for other internal APIs. They do not want the application to redirect users to Snowflake-managed authorization pages or rely on Snowflake to issue OAuth tokens. However, the Snowflake administrators still need to enforce Snowflake role-based access once users connect. Which solution best meets these requirements?
- A
Configure Snowflake OAuth so Snowflake acts as the authorization server and issues access tokens to the application after user consent.
- B
Configure External OAuth so Snowflake trusts access tokens issued by the company’s external IdP, while Snowflake still maps the authenticated user to Snowflake roles for authorization.
- C
Use key-pair authentication instead of OAuth, because OAuth in Snowflake cannot integrate with external identity providers.
- D
Use SAML federated authentication for the application, because SAML tokens can be passed directly to Snowflake drivers in place of OAuth access tokens.
Show answer and explanation
Correct answer: B
Explanation
The key distinction is who acts as the OAuth authorization server. With Snowflake OAuth, Snowflake issues the OAuth access tokens. With External OAuth, a third-party authorization server or identity provider issues the access tokens, and Snowflake validates them through a configured security integration. In both cases, Snowflake still applies its own authorization model, including roles and object privileges. For this scenario, the company wants centralized token issuance by its existing IdP and does not want Snowflake-managed OAuth consent or token issuance, so External OAuth is the correct choice. This aligns with Snowflake best practices for integrating enterprise identity platforms such as Okta, Microsoft Entra ID, or other compliant OAuth providers when centralized authentication is required. Relevant Snowflake documentation includes the sections on Snowflake OAuth and External OAuth, especially the guidance that External OAuth is intended for clients obtaining access tokens from an external OAuth authorization server, while Snowflake OAuth is intended for clients obtaining tokens directly from Snowflake.
- A. Incorrect.
Incorrect. Snowflake OAuth is appropriate when Snowflake itself acts as the OAuth authorization server and issues the access tokens. That does not meet the stated requirement that the company’s centralized IdP must issue the tokens and that the application should not depend on Snowflake-managed authorization flows.
- B. Correct.
Correct. External OAuth is designed for this pattern: an external authorization server or IdP issues the OAuth access token, and Snowflake validates that token based on the configured integration. Authentication is delegated to the external IdP, while Snowflake continues to perform authorization using Snowflake roles and grants. This is the best fit when an organization wants centralized token issuance outside Snowflake.
- C. Incorrect.
Incorrect. Key-pair authentication is a valid non-interactive authentication method for some clients and service accounts, but it does not satisfy the requirement to use the existing centralized OAuth-based IdP. The statement that Snowflake OAuth cannot integrate with external identity providers is also misleading; Snowflake supports External OAuth specifically for that purpose.
- D. Incorrect.
Incorrect. SAML federated authentication is used for browser-based SSO into Snowflake, but SAML assertions are not a replacement for OAuth access tokens in OAuth-enabled client and driver flows. The scenario explicitly requires OAuth tokens issued by the company’s IdP for application access, which aligns with External OAuth rather than passing SAML tokens directly to Snowflake drivers.