Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added the two ways of authentication to the SSO config section #4069

Merged
merged 6 commits into from
Sep 14, 2023
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 56 additions & 8 deletions website/docs/docs/core/connect-data-platform/snowflake-setup.md
Original file line number Diff line number Diff line change
Expand Up @@ -163,9 +163,13 @@ my-snowflake-db:

### SSO Authentication

To use SSO authentication for Snowflake, omit a `password` and instead supply an `authenticator` config to your target. `authenticator` can be one of 'externalbrowser' or a valid Okta URL.
To use SSO authentication for Snowflake, omit a `password` and instead supply an `authenticator` config to your target.
`authenticator` can be one of 'externalbrowser' or a valid Okta URL.

**Note**: By default, every connection that dbt opens will require you to re-authenticate in a browser. The Snowflake connector package supports caching your session token, but it [currently only supports Windows and Mac OS](https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-use.html#optional-using-connection-caching-to-minimize-the-number-of-prompts-for-authentication). See [the Snowflake docs](https://docs.snowflake.com/en/sql-reference/parameters.html#label-allow-id-token) for how to enable this feature in your account.
Refer to the following tabs for more info and examples:

<Tabs>
<TabItem value="externalbrowser" label="externalbrowser">

<File name='~/.dbt/profiles.yml'>

Expand All @@ -175,15 +179,15 @@ my-snowflake-db:
outputs:
dev:
type: snowflake
account: [account id]
user: [username]
role: [user role]
account: [account id] # Snowflake <account_name>
user: [username] # Snowflake username
role: [user role] # Snowflake user role

# SSO config
authenticator: externalbrowser

database: [database name]
warehouse: [warehouse name]
database: [database name] # Snowflake database name
warehouse: [warehouse name] # Snowflake warehouse name
schema: [dbt schema]
threads: [between 1 and 8]
client_session_keep_alive: False
Expand All @@ -199,6 +203,50 @@ my-snowflake-db:

</File>

</TabItem>

<TabItem value="oktaurl" label="Okta URL">

<File name='~/.dbt/profiles.yml'>

```yaml
my-snowflake-db:
target: dev
outputs:
dev:
type: snowflake
account: [account id] # Snowflake <account_name>
user: [username] # Snowflake username
role: [user role] # Snowflake user role

# SSO config -- The three following fields are REQUIRED
authenticator: [Okta account URL]
username: [Okta username]
password: [Okta password]

database: [database name] # Snowflake database name
warehouse: [warehouse name] # Snowflake warehouse name
schema: [dbt schema]
threads: [between 1 and 8]
client_session_keep_alive: False
query_tag: [anything]

# optional
connect_retries: 0 # default 0
connect_timeout: 10 # default: 10
retry_on_database_errors: False # default: false
retry_all: False # default: false
reuse_connections: False # default: false
```

</File>

</TabItem>
</Tabs>

**Note**: By default, every connection that dbt opens will require you to re-authenticate in a browser. The Snowflake connector package supports caching your session token, but it [currently only supports Windows and Mac OS](https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-use.html#optional-using-connection-caching-to-minimize-the-number-of-prompts-for-authentication).

Refer to the [Snowflake docs](https://docs.snowflake.com/en/sql-reference/parameters.html#label-allow-id-token) for info on how to enable this feature in your account.

## Configurations

Expand All @@ -224,7 +272,7 @@ The "base" configs for Snowflake targets are shown below. Note that you should a
| reuse_connections | No | A boolean flag indicating whether to reuse idle connections to help reduce total connections opened. Default is `False`. |

### account
For AWS accounts in the US West default region, you can use `abc123` (without any other segments). For some AWS accounts you will have to append the region and/or cloud platform. For example, `abc123.eu-west-1` or `abc123.eu-west-2.aws`. For GCP and Azure-based accounts, you have to append the region and cloud platform, such as `gcp` or `azure`, respectively. For example, `abc123.us-central1.gcp`. For details, see Snowflake's documentation: "[Specifying Region Information in Your Account Hostname](https://docs.snowflake.com/en/user-guide/intro-regions.html#specifying-region-information-in-your-account-hostname)" and "[Account Identifier Formats by Cloud Platform and Region](https://docs.snowflake.com/en/user-guide/admin-account-identifier.html#account-identifier-formats-by-cloud-platform-and-region)".
For AWS accounts in the US West default region, you can use `abc123` (without any other segments). For some AWS accounts you will have to append the region and/or cloud platform. For example, `abc123.eu-west-1` or `abc123.eu-west-2.aws`. For GCP and Azure-based accounts, you have to append the region and cloud platform, such as `gcp` or `azure`, respectively. For example, `abc123.us-central1.gcp`. For details, see Snowflake's documentation: "[Specifying Region Information in Your Account Hostname](https://docs.snowflake.com/en/user-guide/intro-regions.html#specifying-region-information-in-your-account-hostname)". Please also note that the Snowflake account name should only be the <account_name> without the prefixed <organization_name>. Relevant documentation: "[Account Identifier Formats by Cloud Platform and Region](https://docs.snowflake.com/en/user-guide/admin-account-identifier.html#account-identifier-formats-by-cloud-platform-and-region)".

### client_session_keep_alive

Expand Down