SnowPro Advanced: Security Engineer Question 39
Single answerConfigure SAML, and OAuth authenticationA security engineer is configuring authentication for a Snowflake environment used by two groups. Internal employees must sign in to Snowsight using the company identity provider (IdP) with SAML-based single sign-on. A separate custom application must access Snowflake programmatically without storing user passwords, and the security team wants access tokens to be short-lived and centrally managed. Which solution best meets these requirements?
- A
Configure federated authentication with SAML for employee interactive logins, and configure an OAuth security integration so the custom application can obtain and use OAuth access tokens.
- B
Configure SAML for both employee logins and the custom application, because SAML assertions can be reused directly by applications as long-lived credentials for Snowflake sessions.
- C
Configure key-pair authentication for employees in Snowsight and use OAuth only for administrators, because Snowsight does not support SAML-based SSO.
- D
Configure username/password authentication for the custom application and enforce periodic password rotation, because OAuth in Snowflake is only supported for external client applications accessing external stages.
Show answer and explanation
Correct answer: A
Explanation
The scenario requires matching authentication methods to two distinct access patterns: interactive workforce access and secure programmatic application access. For employee access to Snowsight, SAML federated authentication with an external IdP is the appropriate solution because it enables single sign-on and central identity management. For the custom application, OAuth is the better fit because it avoids embedded passwords and supports short-lived access tokens, aligning with security best practices for token-based access.
This distinction is consistent with Snowflake guidance: SAML is used for federated user authentication, while OAuth is used to authorize client applications to access Snowflake on behalf of a user or service pattern, depending on configuration. A common exam trap is assuming SAML and OAuth are interchangeable; they are not. SAML is generally used for browser-based SSO, whereas OAuth is intended for delegated or token-based API/application access. Another common misconception is that Snowsight cannot use SAML SSO, which is incorrect.
Relevant Snowflake documentation areas include federated authentication/SAML configuration and OAuth security integrations. Candidates should know when to choose SAML versus OAuth based on user interaction model, credential handling requirements, and token lifecycle controls.
- A. Correct.
Correct. SAML federated authentication is the appropriate choice for interactive user sign-in through an IdP, including Snowsight access for employees. For the custom application, OAuth is the correct pattern when the goal is to avoid storing passwords and to use short-lived, centrally governed tokens. In Snowflake, this is implemented through an OAuth security integration, allowing the application to present OAuth access tokens instead of user credentials.
- B. Incorrect.
Incorrect. SAML is designed primarily for browser-based federated sign-on and is not the standard mechanism for a custom application to obtain and present reusable programmatic credentials to Snowflake. Treating SAML assertions as long-lived application credentials is a misconception; Snowflake programmatic authentication for applications is better addressed through OAuth or other supported methods such as key-pair authentication, depending on the use case.
- C. Incorrect.
Incorrect. Snowsight does support SAML-based single sign-on through federated authentication. Key-pair authentication is commonly used for programmatic access, not for interactive employee login to Snowsight. The option also incorrectly limits OAuth to administrators, which is not how Snowflake OAuth is intended to be used.
- D. Incorrect.
Incorrect. Username/password authentication would not satisfy the requirement to avoid storing user passwords in the custom application. The statement about OAuth being only for external client applications accessing external stages is false. Snowflake supports OAuth for client access to Snowflake resources, making it a valid and recommended approach for programmatic access where centralized token management is desired.