SnowPro Advanced: Security Engineer Question 37
Single answerImplement Single-Sign-On (SSO):A company is implementing federated authentication for Snowflake with Microsoft Entra ID (Azure AD) as the identity provider. Security requires that browser-based users sign in with SSO, but service accounts used by automated ETL jobs must continue to authenticate with key-pair authentication and must not be redirected to the identity provider. During testing, administrators enable SSO at the account level and discover that the ETL jobs begin failing because Snowflake attempts to use federated authentication for those users. Which configuration change should the security engineer make to meet both requirements?
- A
Set the account parameter SSO_LOGIN_PAGE to FALSE so Snowflake bypasses SAML authentication for non-interactive users.
- B
Set the account parameter ALLOW_ID_TOKEN to FALSE for service users so they can continue using key-pair authentication.
- C
Alter each ETL service user to set DISABLED = TRUE for federated authentication while keeping key-pair authentication configured.
- D
Alter each ETL service user and set DISABLE_SAML_LOGIN = TRUE so those users are excluded from SAML-based SSO.
Show answer and explanation
Correct answer: D
Explanation
The best answer is to set DISABLE_SAML_LOGIN = TRUE for the service accounts. In Snowflake, SAML2 security integrations are commonly enabled at the account level for workforce SSO, but some accounts such as service users may need to continue using non-SSO methods like key-pair authentication. Snowflake supports this through the user-level DISABLE_SAML_LOGIN property, which prevents those users from being redirected into SAML authentication flows. This is a practical best practice for mixed authentication environments where interactive users use federated SSO and automated workloads use key-pair authentication. By contrast, disabling the user entirely would stop all access, and the other parameters listed do not provide the required per-user exemption from SAML login behavior. This aligns with Snowflake documentation for federated authentication and user properties used to manage exceptions for SSO-enabled accounts.
- A. Incorrect.
Incorrect. SSO_LOGIN_PAGE controls whether the Snowflake sign-in page displays SSO-related behavior, but it is not the control used to exempt specific users from SAML federation. It does not solve the requirement to keep browser users on SSO while preventing ETL service users from being redirected.
- B. Incorrect.
Incorrect. ALLOW_ID_TOKEN is not the user-level control used to exclude Snowflake users from SAML SSO in this scenario. The problem is not about OAuth/OIDC ID token usage; it is specifically about Snowflake attempting SAML-based federated authentication for users that should continue using key-pair authentication.
- C. Incorrect.
Incorrect. DISABLED would prevent the user from authenticating at all, which would break the ETL jobs rather than allow them to continue using key-pair authentication. This option reflects a common misconception that disabling federation is equivalent to disabling the user account.
- D. Correct.
Correct. Setting DISABLE_SAML_LOGIN = TRUE on the ETL service users excludes those users from SAML-based SSO while allowing browser-based human users to continue authenticating through the identity provider. This is the appropriate per-user exception when account-level federated authentication is enabled and some non-interactive users must continue using native Snowflake authentication methods such as key-pair authentication.