Snowflake OAuth Connectivity with Okta and Azure AD

Learn to configure Snowflake OAuth connectivity with Okta.

• Prerequisites
• Create a data import database role with OAuth authentication

Prerequisites

You must have a Snowflake account with an External OAuth integration to Okta. See Configure Okta for External OAuth for more information.

Get the Init OAuth URL and Refresh Token URL

1. Edit the Snowflake authorization server created in Okta.

   1. Navigate to the Okta Admin Console.

   2. In the Security menu, go to API > Authorization Servers.

      

   3. Edit Snowflake's related authorization server.

      

   4. Copy the value for Issuer. The value is similar to https://dev-XXXXX.oktapreview.com/oauth2/YYYYY.

      

   5. To obtain the Init OAuth URL and Refresh Token URL, add the follow values to the Issuer value:

      Init OAuth URL: https://dev-XXXX.oktapreview.com/oauth2/YYYYY/v1/authorize

      Refresh Token URL: https://dev-XXXXX.oktapreview.com/oauth2/YYYYY/v1/token

Get the Client ID and Client Secret

1. Navigate to the Okta Admin Console.
2. From the menu, go to Applications.

3. Select the Snowflake's client application.

   

4. Go to the General tab and scroll down on the page.

   

5. Locate the Client ID and Client Secret.

   

Create a Data Import Database Role with OAuth Authentication

Once the ClientID, ClientSecret, Authorization URL, and Token URL are collected, you can connect to Snowflake using OAuth.

Okta Authentication

1. Open MicroStrategy Web (https://<severname>/MicroStrategy/servlet/mstrWeb).

2. Click Create > Add External Data.

   

3. Choose Snowflake.

   

4. In the Select Import Options dialog, select the Select Tables option.
5. Click Next.
6. Next to Data Sources, click New Data Source .
7. In the Data Source dialog, select Snowflake from the Database and Version drop-downs.

8. Select the OAuth Connection option and complete the required fields.

   

9. Click Save.
10. In the OAuth Properties dialog, choose OKTA from the Authentication Type drop-down and complete the required fields.

11. Copy the Callback URL, as it is needed to whitelist in the Okta authorization server.

    

12. Click OK to save the database connection.
13. In the Okta Admin Console, go to the application created in Step 1: Create an OAuth Compatible Client to Use with Snowflake.
14. Go to the General tab > Edit.

15. Scroll down to the Login redirect URIs section and click Add URI to add the URL to the list.

    

16. Go back to MicroStrategy Web and click on the newly created database instance.

17. Enter the credentials for Okta IdP.

    

18. Click Sign In.

    After logging in, tables and columns that are visible by the Okta user are displayed.

    

 

Learn to configure Snowflake OAuth connectivity with Azure AD.

• Prerequisites
• Create a data import database role with OAuth authentication

Prerequisites

The web server must support HTTPS protocol.

You must have a Snowflake account with an External OAuth integration to Azure AD. See Configure Microsoft Azure AD for External OAuth for more information.

Get the Init OAuth URL and Refresh Token URL

1. Go to the Microsoft Azure Portal and authenticate.
2. Navigate to Azure Active Directory.
3. Click on App Registrations.
4. Click the Snowflake OAuth Resource created in Step 1: Configure the OAuth Resource in Azure AD.
5. Go to Overview > Endpoints.

6. Copy the Oauth 2.0 authorization endpoint (v2) and OAuth 2.0 token endpoint (v2).

   

Get the Scope

1. In the same application, go to API Permissions and click the API/Permission name.

   A dialog appears.

2. Copy the URL and paste in the field. The URL is similar to https://[AzureDomain]/[id]/session:scope-any.

3. Get the Client ID and generate a new Client Secret (if not recorded).

   

   

Create a Data Import Database Role with OAuth Authentication

Once the ClientID, ClientSecret, Tenant ID, Scope, Authorization URL, and Token URL are collected, you can connect to Snowflake using OAuth.

1. Open MicroStrategy Web (https://<severname>/MicroStrategy/servlet/mstrWeb).

2. Click Create > Add External Data.

   

3. Choose Snowflake.

   

4. In the Select Import Options dialog, select the Select Tables option.
5. Click Next.
6. Next to Data Sources, click New Data Source .
7. In the Data Source dialog, select Snowflake from the Database and Version drop-downs.

8. Select the OAuth Connection option and complete the required fields.

   

9. Click Save.
10. In the OAuth Properties dialog, choose Microsoft Azure AD from the Authentication Type drop-down and complete the required fields.

11. Copy the Callback URL, as it is needed to whitelist in Azure AD.

    

12. Click OK to save the database connection.
13. Access the application in Azure AD.

14. Go to Application > Web > Redirect URIs and click Add URI.

    

15. Modify the metadata to allow the storage of long properties.

    Applied Server: MicroStrategy Metadata Warehouse

    1. Back up the metadata warehouse before any operation. Use MicroStrategy DB Query Tool or other database connectors to connect to MicroStrategy Metadata Repository, and execute the following query for the appropriate warehouse type.

       For warehouse types not listed below, please contact MicroStrategy Support for help.

       For MySQL:

       ALTER TABLE DSSMDACCPROP MODIFY PROP_VAL NVARCHAR(30000);
       
       INSERT INTO DSSMDSYSPROP (NAME, PROP_VAL) VALUES ('MAXACCPROPVALCOLUMNLEN', '30000');

       For SQL Server:

       ALTER TABLE DSSMDACCPROP ALTER COLUMN PROP_VAL VARCHAR(8000);
       
       INSERT INTO DSSMDSYSPROP (NAME, PROP_VAL) VALUES ('MAXACCPROPVALCOLUMNLEN', '8000');
       

       For PostgreSQL:

       ALTER TABLE DSSMDACCPROP ALTER COLUMN PROP_VAL TYPE VARCHAR(90000);
       
       INSERT INTO DSSMDSYSPROP (NAME, PROP_VAL) VALUES ('MAXACCPROPVALCOLUMNLEN', '30000');

16. Go back to MicroStrategy Web and click on the newly created database instance.

    The Azure AD authentication dialog appears.

    Your browser must allow popups.

    

    After authenticating, the catalog is populated.