SnowPro Advanced: Security Engineer Question 42
Single answerTroubleshoot SSO integration issuesA company uses federated authentication for Snowflake with an external SAML 2.0 identity provider (IdP). Users report that browser-based SSO to the Snowflake UI works, but when they try to connect from SnowSQL with external browser authentication, they are redirected to the IdP, successfully complete login, and then receive an error indicating the SAML response is not valid for the Snowflake account they are trying to access. The security engineer confirms that the users are assigned correctly in the IdP and that the certificate configured in Snowflake matches the IdP signing certificate. Which configuration issue is the MOST likely cause of this problem?
- A
The SAML2_SNOWFLAKE_ISSUER_URL value configured for the Snowflake security integration does not exactly match the account URL that clients are using to initiate authentication
- B
The IdP is not sending a first name and last name attribute in the SAML assertion, so SnowSQL cannot map the user identity during external browser authentication
- C
The network policy attached to the account is blocking the IdP IP addresses, causing the SAML assertion to be rejected after login
- D
The Snowflake security integration should use an RSA public key instead of the IdP signing certificate for SSO validation
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1. In Snowflake SSO troubleshooting, one of the first checks is whether the account URL used by end users and client tools exactly matches the Snowflake account identifier and URLs configured in the SAML integration and in the IdP. Snowflake is strict about values such as the issuer and the intended audience/recipient in the SAML response. Mismatches commonly occur when teams mix account locator URLs, organization account URLs, region-specific hostnames, privatelink URLs, or old account URLs after an account-name change. This often surfaces in client-based flows like SnowSQL with external browser authentication because the client initiates the flow against a specific account URL. Snowflake documentation for federated authentication and SAML integrations emphasizes validating issuer, audience, ACS/redirect URLs, and ensuring that the IdP configuration matches the exact Snowflake account URL being used.
- A. Correct.
Correct. A common cause of SSO failures in Snowflake is a mismatch between the Snowflake account URL used by the client and the issuer/ACS-related values expected by the SAML integration. Snowflake requires the SAML assertion to be intended for the exact Snowflake account URL associated with the security integration. If users authenticate against one account URL format while the SAML2_SNOWFLAKE_ISSUER_URL or related IdP configuration targets another, browser SSO may appear inconsistent and external browser authentication in clients such as SnowSQL can fail with audience/recipient/account mismatch errors.
- B. Incorrect.
Incorrect. Snowflake SSO relies on the NameID or configured login name mapping, not on first name or last name attributes for core authentication. Missing profile-style attributes may affect provisioning or user metadata expectations in some environments, but they do not typically cause the specific error that the SAML response is not valid for the Snowflake account.
- C. Incorrect.
Incorrect. A network policy can block client access to Snowflake from disallowed source IP addresses, but that would not normally produce a SAML assertion validity error tied to the target Snowflake account after successful IdP authentication. Also, Snowflake does not need inbound access from the IdP in the same way a hosted application server might; the issue described points more directly to SAML configuration mismatch than IP filtering.
- D. Incorrect.
Incorrect. For SAML 2.0 federated authentication, Snowflake validates assertions using the IdP's SAML signing certificate configured in the security integration. RSA key pairs in Snowflake are used for key-pair authentication, not as a replacement for the SAML signing certificate in SSO validation.