Snowflake Authentication from userid/password to key-pair

[davidhcar]

Snowflake recently announced that they are discontinuing the usage of userid/password authentication method in the coming months, the userid/password connections will not be supported from November 1st, 2025. Our organization is moving towards Key-pair based authentication that would avoid using password in the connection string for Snowflake connections.

Requesting the Snowflake connector to support the key-pair authentication in place of userid/password feature with Atlas WebAPI.

Announcement: https://docs.snowflake.com/en/user-guide/security-mfa-rollout?_ga=2.164037754.470643457.1756141295-382733811.1692124158

Key-Pair Authentication doc at snowflake: https://docs.snowflake.com/en/user-guide/key-pair-auth#supported-snowflake-clients

@chrisknoll @anthonysena

[konstjar]

We are evaluating the Key-Pair Authentication in our environment. Right now my understanding is that it should work out of box with recent update of Snowflake JDBC driver. It's just a matter of parameters passed in connection string. More information will be available in upcoming days.

[davidhcar]

@konstjar Appreciate any update on this, it sounds like no code changes necessary to make this work. if so, would you please provide instructions on how to configure?

[konstjar]

@davidhcar

There are 2 alternatives to username password:

1. Key-Pair works out of box right now. You can just follow this instructions:
   https://docs.snowflake.com/en/developer-guide/jdbc/jdbc-configure#using-key-pair-authentication-and-key-rotation

2. PAT. Its support was added in the recent JDBC driver version and requires update.
   There is PR for this: Raised Snowflake JDBC Driver version to 3.26.1 #2464

[davidhcar]

Thanks @konstjar ! Please clarify the following questions,

1. Where do we put the privatekey file, is there a specific location/folder path in the source code or somewhere else? Is there a way to reference from Azure Keyvault keys?
2. Since the privatekey file and its phasephrase is sensitive how Atlas is making sure its not plain text in the source config. Note: For username/password Atlas offers encryption solution with flag jasypt.encryptor.enabled

Please let me know. Thank you for looking into this.

[konstjar]

1. You can put the privatekey file in any location on the host system and specify the path in private_key_file. Do not forget to specify private_key_file_pwd with password for the privatekey file.
   In case you use Docker, you can map the file from host system inside container and specify the path inside container in private_key_file.

2. I do not see solution for this case. WebAPI does not encrypt connection string. You should enable controls on infrastructure level to limit access to the hosting platform.

Example:

jdbc:snowflake://myorganization-myaccount.snowflake.com/?private_key_file=/tmp/rsa_key.p8&private_key_file_pwd=dummyPassword

More details you can find in Snowflake JDBC documentation:
https://docs.snowflake.com/en/developer-guide/jdbc/jdbc-configure#using-key-pair-authentication-and-key-rotation

[anthonysena]

Thanks @davidhcar for reporting this and for @konstjar for the updates/discussion.

I don't want to hijack this issue but wanted to note that I recently ran into a problem with CohortGenerator's GitHub Action Failing on Snowflake with the following error:

Error in `rJava::.jcall(resultSet, "Z", "next")`: net.snowflake.client.jdbc.SnowflakeSQLLoggedException: 
JDBC driver internal error: Max retry reached for the download of #chunk0 (Total chunks: 1) retry=7, 
error=net.snowflake.client.jdbc.SnowflakeSQLLoggedException: JDBC driver encountered 
communication error. Message: No trusted certificate found.

We do use username/password when attempting to connect to Snowflake (ref) and probably an older Snowflake JDBC driver so just wanted to point this out in case it is relevant. I can open a separate issue in HADES for this but wanted to note it here since it seemed somewhat related.

Tagging @schuemie for awareness.

[davidhcar]

Thanks @anthonysena ! Our existing username/password based connection is working well with no issues. I am looking to change this approach to use key/value pair based connection as Snowflake support ends with username/password connections in November 2025.

[konstjar]

@anthonysena Probably is was caused by re-configuration on Snowflake side that we did for PAT testing. It requires enabling firewall in Snowflake with whitelisted IP addresses. Could you please re-run the action to validate?

[davidhcar]

@konstjar Would you remember if the Key-pair supports available with WebAPI version 2.13.0 ? If not would you please let me know which version onward, it supports. Thanks!

cc: @anthonysena @chrisknoll

[konstjar]

@davidhcar
As I recall, JDBC Driver version 3.13.x got key-pair support back in 2022.
WebAPI v2.13 has Snowflake JDBC driver in pom.xml with v3.13.22 which supports key-pair authentication.

[davidhcar]

@konstjar What would be the krb_auth_method value in Source table. The default is PASSWORD and I think it should be different for Key/Value pair authentication.

[davidhcar]

@konstjar @anthonysena @chrisknoll when I provide raw password in querystring as @konstjar suggested, The password contains special characters, I am getting the following error when the system trying to parse the connection string from the source table when trying to connect to snowflake, appreciate your inputs on how to configure the password. Is anybody able to implement the Private Key file with password successfully?

WARN http-nio-8080-exec-5 net.snowflake.client.log.JDK14Logger - [] - Exception thrown while parsing Snowflake connect string. Illegal character in url.

On another note: putting the raw password outside Password column in source table raises security concern but I am just trying to test this out for now. If you know how to protect the private_key_file_pwd please let me know. Thanks!

Appreciate your timely response. Thanks in advance!

[davidhcar]

Hi @konstjar @anthonysena @chrisknoll, Appreciate your response on the issue I described above. Thanks!

@alondhe It looks like you are using the private key file / password based, greatly appreciate your insights on the issue I am facing described above.