ADA-C01 Question 97
Single answerConfigure Snowflake OAuth for custom clientsA company is building an internal web application that will connect directly to Snowflake by using OAuth instead of username/password authentication. The security team requires Snowflake to issue the access tokens, and the developers want to use their own client application rather than Snowflake Partner applications. During testing, the developers report that users can authenticate, but the app cannot complete the OAuth flow because Snowflake does not recognize the client details. Which administrative step should be taken to correctly configure Snowflake OAuth for this custom client?
- A
Create a SECURITY INTEGRATION of type OAUTH with OAUTH_CLIENT = CUSTOM, and define the client redirect URI and other required OAuth settings for the application.
- B
Create a NETWORK POLICY that contains the application's callback URL so Snowflake can validate the custom OAuth client during token exchange.
- C
Create a STORAGE INTEGRATION for the application so Snowflake can store the custom client secret and issue OAuth access tokens.
- D
Create a SECURITY INTEGRATION of type EXTERNAL_OAUTH so Snowflake can act as the authorization server for the custom client.
Show answer and explanation
Correct answer: A
Explanation
This scenario tests the distinction between Snowflake OAuth and External OAuth, and the specific configuration required for custom clients. If Snowflake is issuing the tokens, the admin must configure a SECURITY INTEGRATION for Snowflake OAuth. For a non-partner, organization-built application, the integration must use OAUTH_CLIENT = CUSTOM and include the application's OAuth client details, especially redirect URI configuration. A common mistake is confusing this with EXTERNAL_OAUTH, which is only appropriate when a third-party identity provider acts as the authorization server. Other common misconceptions include thinking network policies govern OAuth callbacks or that another integration type such as STORAGE INTEGRATION is involved. This aligns with Snowflake documentation on CREATE SECURITY INTEGRATION for Snowflake OAuth and the setup of custom OAuth clients.
- A. Correct.
Correct. When Snowflake itself is the authorization server and the organization wants to use a custom client application, the administrator must create a Snowflake OAuth security integration with OAUTH_CLIENT set to CUSTOM. In that integration, the admin configures properties such as redirect URI(s) and related OAuth behavior so Snowflake can recognize and trust the custom client during the authorization and token exchange flow.
- B. Incorrect.
Incorrect. A network policy restricts which IP addresses can connect to Snowflake. It does not register OAuth client metadata such as redirect URIs or client identity. Callback URLs are part of OAuth client configuration, not network access control.
- C. Incorrect.
Incorrect. A storage integration is used for secure access to cloud storage services such as Amazon S3, Google Cloud Storage, or Azure Blob Storage. It has no role in registering OAuth clients, storing OAuth client secrets for custom client authentication, or enabling Snowflake OAuth flows.
- D. Incorrect.
Incorrect. EXTERNAL_OAUTH is used when an external identity provider or authorization server issues the OAuth tokens and Snowflake validates them. In this scenario, the requirement is that Snowflake must issue the access tokens, so Snowflake OAuth, not External OAuth, is the correct model.