SnowPro Advanced: Security Engineer Question 40
Single answerConfigure SAML, and OAuth authenticationA security engineer is implementing authentication for two Snowflake access patterns in a large enterprise. Interactive analysts must sign in to Snowsight using the company’s Okta identity provider with MFA enforced by Okta. Separately, a custom internal web application must call Snowflake on behalf of signed-in users without storing Snowflake passwords, and the security team wants issued access to be time-limited and standards-based. Which configuration best meets both requirements?
- A
Configure SAML 2.0 federation between Okta and Snowflake for Snowsight user sign-in, and configure an OAuth security integration in Snowflake so the application can obtain OAuth tokens for Snowflake access.
- B
Configure key-pair authentication for Snowsight users so Okta can enforce MFA, and use a network policy for the application instead of OAuth because network policies provide token-based authorization.
- C
Configure SCIM provisioning for Snowsight authentication, and use external browser authentication for the custom application because it avoids storing Snowflake passwords and is designed for service-to-service API access.
- D
Configure SAML 2.0 federation for both Snowsight and the custom application, because SAML assertions are the recommended mechanism for both browser sign-in and delegated API authorization to Snowflake.
Show answer and explanation
Correct answer: A
Explanation
The scenario has two distinct authentication needs, and Snowflake best practice is to use the protocol that matches each access pattern. For interactive browser-based user sign-in to Snowsight, SAML 2.0 federation with an external IdP such as Okta is the standard solution. This allows the enterprise to centralize authentication controls such as MFA in the IdP. For a custom application that must access Snowflake on behalf of users without storing Snowflake passwords, OAuth is the correct approach because it provides standards-based, time-limited tokens for delegated access. In Snowflake, this is implemented through an OAuth security integration. SCIM is only for identity lifecycle management, not authentication. Network policies are compensating access controls based on IP/network boundaries, not a replacement for authentication protocols. These distinctions align with Snowflake documentation on federated authentication using SAML and application authorization using OAuth security integrations.
- A. Correct.
Correct. SAML 2.0 federation is the standard approach for browser-based single sign-on into Snowflake, including Snowsight, using an external IdP such as Okta. In this model, MFA can be enforced by the IdP. For the custom web application, OAuth is the correct standards-based mechanism when the application needs to obtain time-limited access tokens and avoid storing Snowflake passwords. Snowflake supports OAuth via security integrations for this purpose.
- B. Incorrect.
Incorrect. Key-pair authentication is primarily used for programmatic access, such as SnowSQL, connectors, or service accounts, not for Snowsight browser SSO with Okta MFA. Also, network policies restrict allowed client network locations; they do not issue tokens and are not an authentication or delegated authorization mechanism. This option mixes unrelated controls.
- C. Incorrect.
Incorrect. SCIM is for automated provisioning and deprovisioning of users and groups, not for authenticating users into Snowflake. External browser authentication can support user authentication flows for some client connections, but it is not the right answer for a custom application that needs standards-based delegated access tokens for API-style access on behalf of a user. OAuth is designed for that use case.
- D. Incorrect.
Incorrect. SAML is appropriate for federated browser sign-in, but it is not Snowflake’s general mechanism for delegated API authorization from a custom application. For application access using time-limited tokens, Snowflake uses OAuth. A common misconception is to treat SAML and OAuth as interchangeable because both involve federation and external identity, but they solve different problems.