ARA-C01 Question 316
Single answerJDBCA company is migrating a Java-based reporting application from an on-premises database to Snowflake. The application uses the Snowflake JDBC driver and runs long-lived connection pools. Security requirements state that users must authenticate through the corporate SSO provider, and operations has reported intermittent failures after several hours because sessions expire and users are prompted to re-authenticate. The architecture team wants to minimize user disruption while preserving SSO-based authentication. Which approach should be implemented?
- A
Configure the JDBC connection to use the externalbrowser authenticator and enable connection caching in the pool so the original SSO session can be reused indefinitely.
- B
Use key pair authentication for the service account used by the application, and keep SSO for interactive human users outside the application.
- C
Switch the JDBC driver to use username/password authentication and enforce network policies, because JDBC does not support SSO for pooled connections.
- D
Configure the JDBC driver to use the oauth authenticator with refresh tokens issued through the corporate IdP, so the application can renew access without repeated browser-based logins.
Show answer and explanation
Correct answer: D
Explanation
The key architectural issue is that browser-based SSO via the JDBC driver's externalbrowser authenticator is designed primarily for interactive user authentication, not for resilient unattended renewal in long-running application pools. In contrast, OAuth-based authentication can support token-based access patterns that integrate with enterprise IdPs and avoid repeated browser prompts, provided the organization's security and token issuance policies allow refresh-token-based renewal. Snowflake JDBC supports multiple authenticators, including externalbrowser and oauth. For service-to-service patterns, key pair authentication is also a strong option, but in this scenario it does not satisfy the requirement to preserve SSO-based authentication through the corporate identity provider. This aligns with Snowflake best practices for selecting authentication methods based on whether the workload is interactive, federated, or non-interactive, and with Snowflake JDBC driver documentation on supported authenticators and connection properties.
- A. Incorrect.
Incorrect. The externalbrowser authenticator is appropriate for interactive SSO sign-in, but it is a poor fit for unattended or long-lived pooled application connectivity. Reusing pooled connections does not guarantee indefinite reuse of the underlying authentication state, and expired sessions can still force re-authentication. This option reflects a common misconception that connection pooling solves identity token lifecycle issues.
- B. Incorrect.
Incorrect. Key pair authentication is a valid and commonly recommended non-interactive authentication method for service accounts using Snowflake clients, including JDBC. However, the scenario explicitly requires that users authenticate through the corporate SSO provider while minimizing disruption. Replacing the application's SSO-based model with key pair authentication changes the authentication design rather than preserving SSO-based authentication.
- C. Incorrect.
Incorrect. Snowflake JDBC does support federated authentication and SSO-related patterns. Moving to username/password would weaken alignment with the stated security requirement and is not necessary solely because the application uses pooled JDBC connections. Network policies can help restrict access but do not address the need for centralized SSO-based authentication or token renewal.
- D. Correct.
Correct. For applications that must preserve enterprise identity integration without repeated interactive authentication prompts, using OAuth with the Snowflake JDBC driver is an appropriate design. With oauth as the authenticator, the application can present OAuth access tokens and, depending on the enterprise authorization flow, use refresh tokens from the IdP to obtain new access tokens without repeatedly launching an interactive browser flow. This is much better suited to long-lived pooled connections than externalbrowser.