SnowPro Advanced: Security Engineer Question 88
Single answerOAuthA security engineer is integrating a custom internal web application with Snowflake so users can sign in with the company's existing identity provider (IdP) and query Snowflake without storing Snowflake passwords in the application. The organization requires centralized control of authentication at the IdP and wants Snowflake to trust OAuth access tokens issued by that IdP. Which configuration should the engineer implement to meet these requirements?
- A
Configure Snowflake External OAuth with the corporate IdP as the authorization server, and have the application present the IdP-issued OAuth access token to Snowflake.
- B
Configure Snowflake OAuth so Snowflake issues the access token after users authenticate to the corporate IdP, because Snowflake OAuth is designed for third-party IdP-issued tokens.
- C
Create key pair authentication for all users and store private keys in the application so Snowflake can validate them instead of OAuth tokens.
- D
Use SAML SSO for the application-to-Snowflake connection, because SAML assertions can be sent directly on every SQL request in place of OAuth access tokens.
Show answer and explanation
Correct answer: A
Explanation
The key requirement is that the corporate IdP remains the authorization server and that Snowflake trusts OAuth access tokens issued by that external system. In Snowflake, this is implemented with External OAuth, not Snowflake OAuth. Snowflake OAuth is for cases where Snowflake issues the tokens. External OAuth is commonly used with enterprise identity platforms to support centralized authentication and authorization patterns for custom applications and API-driven access. This distinction is a core exam concept: choose Snowflake OAuth when Snowflake is the token issuer; choose External OAuth when an external IdP issues the token. Snowflake documentation on OAuth describes both models and their intended use cases, including External OAuth integration with supported identity providers.
- A. Correct.
Correct. External OAuth is the Snowflake feature designed for trusting OAuth access tokens issued by an external authorization server, such as a corporate IdP. This aligns with the requirement for centralized authentication control at the IdP and avoids storing Snowflake passwords in the application. In this model, Snowflake validates the externally issued token and maps it appropriately for access.
- B. Incorrect.
Incorrect. Snowflake OAuth uses Snowflake itself as the authorization server. It is appropriate when Snowflake should issue OAuth tokens for client access to Snowflake. It is not the correct choice when the requirement is specifically for Snowflake to trust tokens issued by the corporate IdP.
- C. Incorrect.
Incorrect. Key pair authentication is a valid non-password authentication mechanism for service-style access, but it does not satisfy the requirement for centralized user authentication through the company's IdP using OAuth. Storing private keys in the application for end-user sign-in also introduces different operational and security considerations and does not provide IdP-issued OAuth token trust.
- D. Incorrect.
Incorrect. SAML SSO can be used for interactive user authentication to Snowflake, especially for browser-based login, but it is not the mechanism Snowflake uses for OAuth token-based API or driver access in this scenario. A SAML assertion is not typically passed on every SQL request as a substitute for an OAuth access token.