Configure Auth0 for a Snowflake connection

Learn how to configure Auth0 for a Snowflake connection.

Steps to retrieve OAuth details from the Auth0 application

  1. Sign in to Auth0 and create an Auth0 application.

    1. Navigate to the Applications section in the Auth0 dashboard.

    2. Under Application type, choose Regular Web Application.

    3. Under Application technology, choose Java.

  2. Gather the basic credentials.

    1. Under the application’s Settings tab, collect the following information:

      • Client ID

      • Client Secret

      • Issuer, or domain. It will be in the format https://<domain>/.

  3. Locate the OAuth endpoints.

    1. Navigate to the Endpoints tab under Advanced Settings.

    2. Note the following URLs:

      • OAuth Authorization URL

      • OAuth Token URL

      • JSON Web Key Set (JWKS) URL

Create an API in Auth0 and configure permissions

  1. Go to the APIs section in the Auth0 dashboard and select Create API.

  2. Provide a Name and an Identifier-- the identifier will be used as the aud (audience) in tokens and must match the value set for EXTERNAL_OAUTH_AUDIENCE_LIST in your Snowflake security integration.

  3. After creating the API, navigate to the Permissions tab and add the following scope:

    session:role-any

    This allows the authenticated user to assume any role in Snowflake.

Create a user in Auth0 and assign permissions

  1. Create a user in Auth0.

    1. Go to the Auth0 dashboard and navigate to Users under User management.

    2. Click Create User.

    3. Fill in the following user details:

      • Email

      • Password

    4. Choose the connection (for example, username-password-authentication).

    5. Click Create.

  2. Navigate to the Permissions tab.

    1. Click Add Permissions and select the API you created for Snowflake.

    2. Confirm the scope: session:role-any.

Create a script to create custom claim and assign all the scopes to the token

  1. Navigate to Actions and select Build a New Action under Library.

    1. Add a name, for example, Add custom claim and scopes.

  2. Set the trigger as Post Login.

  3. Paste the following script:

    exports.onExecutePostLogin = async (event, api) => {
 let scopes = (event.request.query.scope || '').split(" ");


 for (let i = 0; i < scopes.length; i++) {
     if (scopes[i]) {
         api.accessToken.addScope(scopes[i]);
     }
 }


 const user = event.user;
 // Set the UPN to the user's email or another custom field
 api.idToken.setCustomClaim("upn", user.name);
 api.accessToken.setCustomClaim("upn", user.name);


};

    This script will add a custom claim (for example, upn), and add all the scoped granted to the user (form their roles/permissions) into the Access Token.

  4. To deploy the action, click Deploy and Attach to Post Login Flow.

Create security integration in Snowflake

  1. Create security integration in Snowflake using the following:

    CREATE or replace SECURITY INTEGRATION <Integration name>
  TYPE = EXTERNAL_OAUTH
  ENABLED = TRUE
  EXTERNAL_OAUTH_TYPE = CUSTOM
  external_oauth_any_role_mode = 'ENABLE'
  EXTERNAL_OAUTH_ISSUER = '<Issuer>'
  external_oauth_audience_list = ('<audience>')
  EXTERNAL_OAUTH_JWS_KEYS_URL = '<jws-key-json-url>'
  EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'upn'
  EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name'
  EXTERNAL_OAUTH_SCOPE_DELIMITER=' '
  EXTERNAL_OAUTH_SCOPE_MAPPING_ATTRIBUTE = scope;

Create a user in Snowflake

  1. Create user in Snowflake using the following:

    CREATE or replace USER "<email>"
  COMMENT = 'auth0'
  DEFAULT_ROLE = DEV
  MUST_CHANGE_PASSWORD = FALSE
  LOGIN_NAME = '<email>';

    The user should have a default role and warehouse assigned.

    Since EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE is specified as upn, it should match with the name of the user created in Auth0.

Create the connection in ThoughtSpot

  1. Navigate to ThoughtSpot’s Data workspace tab, select + Create new, and click Connection.

  2. Select Snowflake as the type and click Next.

  3. Select External OAuth as the authentication type and fill out all fields.

  4. Under Advanced Config, fill in the following key-value pair:

    • Key: appendToAuthURL

    • Value: audience=<audience>

  5. Create the Connection.

Related information

Was this page helpful?
×