ARA-C01 Question 106
Single answerSingle Sign-On (SSO)A company uses Microsoft Entra ID as its corporate identity provider and is rolling out Snowflake to 3,000 employees. Security requires centralized authentication through SAML 2.0 SSO, while the data engineering team needs a small set of service accounts for unattended ETL jobs. During testing, users can authenticate successfully through the browser-based SSO flow, but the ETL jobs fail because they cannot complete interactive login. The architect must meet both requirements without weakening the organization's authentication standards. Which approach should the architect recommend?
- A
Configure Snowflake to use SAML SSO for human users and use key-pair authentication for the service accounts running ETL jobs
- B
Configure the ETL service accounts to use the same SAML SSO flow as human users and store the IdP session cookies for reuse by the jobs
- C
Disable SSO for the entire Snowflake account and require all users and service accounts to authenticate with username and password
- D
Use SCIM provisioning to authenticate the ETL jobs because SCIM is designed for non-interactive identity workflows in Snowflake
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SAML 2.0 SSO for human users and a non-interactive authentication mechanism for service accounts, with key-pair authentication being the recommended approach for unattended workloads. In Snowflake, SSO via SAML is designed for federated user authentication through an identity provider and is typically interactive. Service accounts used by ETL tools, schedulers, or custom applications should not depend on browser-based SSO flows. Snowflake documentation and architecture best practices distinguish between workforce authentication methods, such as SAML SSO, and programmatic authentication methods for automation, such as key-pair authentication. It is also important to distinguish SCIM from SSO: SCIM handles provisioning, not authentication. An architect should therefore design Snowflake authentication so that interactive users are federated through the enterprise IdP while machine identities use secure non-interactive credentials appropriate for automated access.
- A. Correct.
Correct. In Snowflake, SAML 2.0 SSO is intended for interactive user authentication, typically through a browser or supported client flow integrated with the IdP. Non-interactive workloads such as scheduled ETL jobs should use a supported programmatic authentication method, and key-pair authentication is a standard best practice for service users because it avoids interactive prompts and reduces reliance on passwords. This design satisfies centralized SSO for workforce users while allowing automation accounts to authenticate securely.
- B. Incorrect.
Incorrect. SAML SSO is not a good fit for unattended batch jobs because it depends on an interactive authentication flow with the identity provider. Attempting to persist and reuse IdP session cookies for automation is operationally fragile and does not align with standard Snowflake authentication patterns for service principals or service users. This option reflects the common misconception that the same browser-based SSO mechanism can simply be reused for headless processes.
- C. Incorrect.
Incorrect. Disabling SSO for everyone would violate the stated requirement for centralized authentication and weaken the organization's security posture. Snowflake supports mixing authentication methods by user, so there is no need to abandon SSO for the workforce just because some non-interactive service accounts require a different authentication mechanism.
- D. Incorrect.
Incorrect. SCIM in Snowflake is used for automated provisioning and deprovisioning of users and roles, not for runtime authentication to Snowflake sessions. This option confuses identity lifecycle management with authentication. Even if SCIM is enabled with an IdP, ETL jobs still need a supported authentication method such as key-pair authentication.