ARA-C01 Question 115
Single answerSecurity integrationA company uses Snowflake for analytics and wants employees to sign in with its corporate Identity Provider (IdP) using SAML 2.0. The security team requires that Snowflake access be managed centrally in the IdP, and that user membership in IdP groups automatically determine which Snowflake roles users receive at login. The architects also want to minimize ongoing manual role grants inside Snowflake. Which approach best meets these requirements?
- A
Create a SAML2 security integration and configure SCIM so users and groups are provisioned from the IdP into Snowflake, then map the synchronized groups to Snowflake roles.
- B
Create an OAuth security integration and use access token scopes to assign Snowflake database roles dynamically at login.
- C
Create an external function integration so the IdP can call Snowflake and update role grants every time a user authenticates.
- D
Create a network policy tied to the IdP's IP ranges so Snowflake can infer a user's corporate group membership during login.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to combine a SAML2 security integration for federated authentication with SCIM-based provisioning for centralized user and group lifecycle management. In Snowflake, SAML security integrations are used to enable SSO with an external IdP. When the requirement extends beyond authentication to centralized management of users and their access, SCIM is the best-practice approach because it automates provisioning and group synchronization from the IdP into Snowflake. This reduces manual administration and supports role assignment based on IdP-managed groups. OAuth integrations, external functions, and network policies serve different purposes and do not satisfy the requirement for centralized SSO plus automated role mapping. Refer to Snowflake documentation on federated authentication with SAML, SCIM support, and security integrations for the supported architecture and implementation details.
- A. Correct.
Correct. For federated authentication with a corporate IdP using SAML 2.0, Snowflake uses a SAML2 security integration. If the goal is centralized lifecycle and access management, SCIM provisioning is the appropriate complementary capability to sync users and groups from the IdP into Snowflake. Those groups can then be associated with Snowflake roles, reducing manual administration and aligning access with IdP-managed group membership. This is the standard pattern for centralized identity and role management in Snowflake.
- B. Incorrect.
Incorrect. OAuth security integrations are used for token-based authorization scenarios, such as client applications authenticating to Snowflake APIs or services. OAuth scopes do not provide a mechanism to dynamically assign Snowflake roles from enterprise group membership at interactive SSO login in the way described. This option confuses application authorization with workforce SSO and role provisioning.
- C. Incorrect.
Incorrect. External functions are for invoking external services from SQL, not for driving authentication-time role assignment. They are not part of Snowflake's SSO flow and would add unnecessary complexity, latency, and operational risk. Role grants managed by calling back into Snowflake at every login is not the intended or supported pattern for centralized identity integration.
- D. Incorrect.
Incorrect. Network policies restrict access based on allowed or blocked IP addresses. They do not integrate with IdP group claims and cannot determine or assign Snowflake roles based on a user's corporate group membership. This option reflects a common misunderstanding between network-level controls and identity/authorization controls.