Snowflake MFA, Passkeys, SAML SSO and OAuth Sign-In

1.Snowflake-managed MFA: who enrolls, and with which authenticator

Snowflake-managed MFA protects one kind of sign-in: a human user who signs in with a password. After entering the password, an enrolled user must also present a second factor. Service users can't use MFA. They need another way to authenticate, such as the key pairs and tokens covered in the programmatic-access lesson.

Whether enrollment is required depends on when the account was created. An account that existed before the 2024_08 behavior change bundle was enabled must be configured to require MFA. An account created after that bundle requires MFA by default for every human user who signs in with a password. In those newer accounts, you can relax the requirement by setting an authentication policy with MFA_ENROLLMENT=OPTIONAL on the account. Even then, Snowsight password users still need MFA, and Snowflake describes this opt-out as temporary because single-factor password sign-ins are being deprecated.

Administrators choose which of these methods are allowed with the MFA_POLICY clause of an authentication policy. The policy below requires enrollment and accepts passkeys and authenticator apps, but not Duo:

CREATE AUTHENTICATION POLICY mfa_policy
  MFA_ENROLLMENT = REQUIRED
  MFA_POLICY = (ALLOWED_METHODS = ('PASSKEY', 'TOTP'));

Sources1

2.Externally-managed MFA for SSO users

Externally-managed MFA means that the IdP enforces the second factor, not Snowflake. This is the default for SAML and OIDC users. If you don't trust that boundary for high-privilege users, an authentication policy can add Snowflake MFA after IdP sign-in. The policy lists the allowed methods and the security integrations they may use. It requires enrollment, and the MFA_POLICY clause sets ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION. The example below is named for its typical use, administrators who must pass both factors.

CREATE AUTHENTICATION POLICY ACCOUNTADMIN_DOUBLE_MFA
  AUTHENTICATION_METHODS = ('PASSWORD', 'SAML', 'OIDC')
  SECURITY_INTEGRATIONS = ('<SAML OR OIDC SECURITY INTEGRATIONS>')
  MFA_ENROLLMENT = 'REQUIRED'
  MFA_POLICY=( ? ='ALL');

Sources1

3.Recovering locked-out users and break-glass access

Lockouts happen when a user loses the device that holds their second factor. Administrators have two ways to recover the user. To have the user enroll a new factor, run ALTER USER joe ENROLL MFA;. If the user has a verified email, Snowflake emails them a prompt. If not, Snowflake returns a URL that the administrator passes on. To allow a single-factor password sign-in for a limited window, run ALTER USER joe SET MINS_TO_BYPASS_MFA = 30;. Before re-enrolling, list the user's factors with SHOW MFA METHODS FOR USER joe, then drop the one that is gone with ALTER USER … REMOVE MFA METHOD.

Break glass covers a different failure: the usual sign-in path is unavailable, for example because the IdP is down. Snowflake's pattern is a dedicated user whose password is kept in a key vault together with pre-generated one-time passcodes (OTPs). Signing in with the password plus an OTP still meets the MFA requirement. Each OTP works only once. Generating a new batch invalidates every earlier passcode, which is also how you revoke them all at once.

ALTER USER breakglass_user ADD MFA METHOD OTP COUNT = 5;

Sources1

4.Configuring SAML2 single sign-on

SSO moves the first factor to your IdP. Snowflake represents the trust relationship as a SAML2 security integration, which replaces the deprecated SAML_IDENTITY_PROVIDER account parameter. The recommended way to describe the IdP is METADATA_URL. With it, Snowflake fetches the IdP's settings, including its certificate, dynamically, so you don't have to paste them in by hand.

On the service-provider side, the two Snowflake URLs must exactly match the account URL you registered at the IdP. If you omit them, they default to the account's legacy URL. Snowflake appends /fed/login to the ACS URL. The example uses a private-connectivity account URL:

CREATE SECURITY INTEGRATION my_idp
  TYPE = saml2
  ENABLED = true
  METADATA_URL = 'https://integrator-26580.okta.com/app/ex2kbcS30N697/sso/saml/metadata'
  SAML2_SNOWFLAKE_ISSUER_URL = 'https://<orgname>-<account_name>.privatelink.snowflakecomputing.com'
  SAML2_SNOWFLAKE_ACS_URL = 'https://<orgname>-<account_name>.privatelink.snowflakecomputing.com/fed/login';

Snowflake decrypts encrypted assertions with its own private key and never exports that key. By default, the certificate is self-signed. If you need a CA-issued certificate, generate a CSR with SYSTEM$GENERATE_SAML_CSR and upload the issued certificate into SAML2_SNOWFLAKE_X509_CERT.

Sources2

5.External OAuth, and troubleshooting failed SSO

OAuth is the other IdP-driven path, used mostly by applications that act for a user. Snowflake supports both Snowflake OAuth and External OAuth. The sources for this lesson cover only the External OAuth flow, so the configuration parameters of Snowflake OAuth integrations are not described here. External OAuth does not depend on where the authorization server runs, whether in any cloud or on-premises. You set up trust once with a security integration. After that, every access attempt follows a fixed sequence.

A failed SAML sign-in gives the user a UUID. Pass the UUID to SYSTEM$GET_LOGIN_FAILURE_DETAILS to get the error code, then look the code up:

SELECT JSON_EXTRACT_PATH_TEXT(SYSTEM$GET_LOGIN_FAILURE_DETAILS('eb55b777-50a4-4db5-b231-9ee457fb3981'), 'errorCode');

Destination and audience errors usually mean the issuer or ACS URLs don't match what the IdP was given. Signature errors usually follow an IdP certificate change. If the integration uses METADATA_URL, ALTER SECURITY INTEGRATION … REFRESH METADATA_URL re-reads the IdP's settings without changing any other parameter.

Sources345

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.Requiring MFA_ENROLLMENT also forces SSO users through Snowflake MFA.Why is that wrong?

   By default, Snowflake leaves MFA for SSO users to the IdP. Snowflake MFA after IdP sign-in only applies when an authentication policy sets ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION.

   Covered in Externally-managed MFA for SSO users

2. 2.SAML2_SNOWFLAKE_ACS_URL is just the plain account URL.Why is that wrong?

   The ACS URL is the account URL with /fed/login appended, and it must match the URL configured at the IdP.

   Covered in Configuring SAML2 single sign-on

3. 3.Rotating the IdP certificate means rebuilding the SAML2 integration.Why is that wrong?

   When the integration uses METADATA_URL, a REFRESH METADATA_URL re-reads the IdP's settings, including its certificate, without changing any parameters.

   Covered in External OAuth, and troubleshooting failed SSO