## Enable Snowflake OAuth

URL: https://docs.atlan.com/apps/connectors/data-warehouses/snowflake/how-tos/enable-snowflake-oauth

> Atlan supports [Snowflake OAuth-based authentication](https://docs.snowflake.com/user-guide/oauth-snowflake-overview) for [Snowflake](/apps/connectors/data-ware.

Atlan supports [Snowflake OAuth-based authentication](https://docs.snowflake.com/user-guide/oauth-snowflake-overview) for [Snowflake](https://docs.atlan.com/llms/connectors/snowflake/set-up-snowflake/llms.txt) connections. Once the integration has been completed, Atlan generates a trusted secure token with Snowflake. This enables Atlan to authenticate users with Snowflake on their behalf to:

- [Query data with Snowflake OAuth credentials](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt)
- [View sample data with Snowflake OAuth credentials](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt)

This page covers the Okta flow. For PingFederate as the identity provider, see [Enable Snowflake OAuth with PingFederate](https://docs.atlan.com/llms/connectors/snowflake/enable-snowflake-oauth-with-pingfederate/llms.txt).

## Configure Snowflake OAuth in Atlan

:::warning Who can do this?
 You must be a [connection admin](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt) in Atlan to complete these steps. You also need inputs and approval from your [Snowflake account administrator](https://docs.snowflake.com/en/user-guide/security-access-control-overview#roles).

:::

To configure Snowflake OAuth on a Snowflake connection, from Atlan:

1. From the left menu of any screen, click **Assets**.
2. From the _Assets_ page, click the **Connector** filter, and from the dropdown, click **Snowflake**.
3. From the pills below the search bar at the top of the screen, click **Connection**.
4. From the list of results, select a Snowflake connection to enable Snowflake OAuth-based authentication.
5. From the sidebar on the right, next to _Connection settings_, click **Edit**.
6. In the _Connection settings_ dialog:
 - Under _Allow query_, for _Authentication type_, click **Snowflake OAuth** to enforce Snowflake OAuth credentials for [querying data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt): 
 1. For _Authentication Required_, click **Copy Code** to copy a security authorization code to [execute it in Snowflake](https://docs.atlan.com/llms/connectors/snowflake/enable-snowflake-oauth/llms.txt).
 - Under _Display sample data_, for _Source preview_, click **Snowflake OAuth** to enforce Snowflake OAuth credentials for [viewing sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt):
 - If Snowflake OAuth-based authentication is enabled for querying data, the same connection details are reused for viewing sample data.
 - If a different authentication method is enabled for querying data, click **Copy Code** to copy a security authorization code to [execute it in Snowflake](https://docs.atlan.com/llms/connectors/snowflake/enable-snowflake-oauth/llms.txt).
7. (Optional) Toggle on **Enable data policies created at source to apply for querying in Atlan** to apply any data policies and user permissions at source to querying data and viewing sample data in Atlan. If toggled on, any existing [data policies](https://docs.atlan.com/llms/governance/access-control/what-are-purposes/llms.txt) on the connection in Atlan are deactivated and creation of new data policies are disabled.
8. At the bottom right of the _Connection settings_ dialog, click **Update**.

:::info **Did you know?** 
 The refresh token doesn't expire by default.

:::

## Create security integration in Snowflake

:::warning Who can do this?
 You must have your [Snowflake account administrator](https://docs.snowflake.com/en/user-guide/oauth-ext-custom#step-2-create-an-external-oauth-security-integration-in-snowflake) to run these commands. You also need to have an [existing Snowflake connection](https://docs.atlan.com/llms/connectors/snowflake/set-up-snowflake/llms.txt) in Atlan.

:::

To create a security integration in Snowflake:

1. Log in to your Snowflake instance.
2. From the top right of your Snowflake instance, click the **+** button, and then from the dropdown, click **SQL Worksheet** to open a new worksheet.
3. In the query editor of your Snowflake SQL worksheet, paste the [security authorization code you copied in Atlan](https://docs.atlan.com/llms/connectors/snowflake/enable-snowflake-oauth/llms.txt). See a representative example below:

 ```javascript
 CREATE SECURITY INTEGRATION <name>
 TYPE = EXTERNAL_OAUTH
 ENABLED = TRUE
 EXTERNAL_OAUTH_TYPE = OKTA
 EXTERNAL_OAUTH_ISSUER = 'https://.okta.com/oauth2/'
 EXTERNAL_OAUTH_JWS_KEYS_URL = 'https://.okta.com/oauth2//v1/keys'
 EXTERNAL_OAUTH_AUDIENCE_LIST = ('<snowflake_account_url')
 EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub'
 EXTERNAL_OAUTH_ANY_ROLE_MODE = 'ENABLE';
 EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'EMAIL_ADDRESS'
 ```

4. Run the security integration in Snowflake.
5. (Optional) To enable the `ACCOUNTADMIN`, `ORGADMIN`, or `SECURITYADMIN` role to query with Snowflake OAuth-based authentication, add and run the following command to set account-level permissions:

 ```javascript
 ALTER ACCOUNT SET EXTERNAL_OAUTH_ADD_PRIVILEGED_ROLES_TO_BLOCKED_LIST = FALSE;
 ```

Your users can [run queries](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) and [view sample data](https://docs.atlan.com/llms/governance/access-control/authenticate-sso-credentials-to-query-data/llms.txt) using their Snowflake OAuth credentials! 🎉

:::info **Did you know?** 
 You can refer to [troubleshooting connector-specific SSO authentication](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt) to troubleshoot any errors.

:::

---