Snowflake OAuth - Paradime

With Snowflake OAuth, users authorize their Code IDE credentials through Single Sign-On (SSO) via Snowflake rather than submitting a username and password to Paradime.

Available in: Code IDE only. The Bolt and Agent environments run non-interactively, so they use a dedicated service user with username and password or key-pair authentication instead.

If Snowflake is set up with SSO through a third-party identity provider, developers can use this method to log into Snowflake and authorize their dbt™ Code IDE credentials without any additional setup.

Configuring a security integration

To enable Snowflake OAuth, create a security integration in Snowflake to manage the OAuth connection between Paradime and Snowflake.

Only Snowflake account administrators (users with the ACCOUNTADMIN role) or a role with the global CREATE INTEGRATION privilege can execute this SQL command.

Execute the query below to create a security integration. See the full documentation on creating a security integration for custom clients here.

lineNumbers

CREATE OR REPLACE SECURITY INTEGRATION PARADIME
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = '<the redirect URI based on your paradime instance region>'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

Field	Description
`TYPE`	Required.
`ENABLED`	Required.
`OAUTH_CLIENT`	Required.
`OAUTH_CLIENT_TYPE`	Required.
`OAUTH_REDIRECT_URI`	Required. Use the redirect URI for your region (check your selected region during onboarding in Workspace Settings > Workspace Management): 🇪🇺 eu-west-2 (Europe - London): `https://api.paradime.io/control-plane/snowflake/redirect` 🇪🇺 eu-west-1 (Europe - Ireland): `https://eu-w1-api.paradime.io/control-plane/snowflake/redirect` 🇪🇺 eu-central-1 (Europe - Frankfurt): `https://eu-c1-api.paradime.io/control-plane/snowflake/redirect` 🇺🇸 us-east-1 (US East - N. Virginia): `https://api.us.paradime.io/control-plane/snowflake/redirect`
`OAUTH_ISSUE_REFRESH_TOKENS`	Required.
`OAUTH_REFRESH_TOKEN_VALIDITY`	Required. The number of seconds a refresh token is valid for. Use a smaller value to force users to re-authenticate with Snowflake more frequently.
`OAUTH_USE_SECONDARY_ROLES`	Optional. Allows default secondary roles to be set in OAuth sessions.

Retrieve the Client ID and Secret

To get the Client ID and Secret required to connect to Paradime, run the query below in Snowflake:

lineNumbers

with

integration_secrets as (
  select parse_json(system$show_oauth_client_secrets('PARADIME')) as secrets
)

select
  secrets:"OAUTH_CLIENT_ID"::string     as client_id,
  secrets:"OAUTH_CLIENT_SECRET"::string as client_secret
from
  integration_secrets;

Enter the connection fields

This is a Code IDE method. An Admin sets the workspace-level fields (Profile Name, Target, Account, Client ID, Client Secret), and each developer sets their own user-level fields when authorizing their connection.

Field	Description	Example
Profile Name	The profile name set in your `dbt_project.yml`. See more here.	`dbt-snowflake`
Target	The target name used to identify the connection. See more here.	`dev`
Account	The Snowflake account to connect to, as per Snowflake’s documentation.	`vj71689.eu-west-2.aws`
Client ID	The Client ID retrieved from the security integration above.	`UPWBLFUTwT7hJ+JDbNthut3rF3w=`
Client Secret	The Client Secret retrieved from the security integration above.	`7FMKYoOP9+KUh2qqVHXfsZStUJLpiaa/ojFmvGwr06E=`
Role	The role to assume when running queries as the specified user.	`transformer`
Database	The name of your Snowflake database.	`analytics`
Warehouse	The virtual warehouse to use for running queries.	`transforming`
Schema	The default schema used to build dbt™ objects at runtime.	`dbt_john`
Threads	The number of threads used in this connection. See more here.	`8`

​Configuring a security integration

​Retrieve the Client ID and Secret

​Enter the connection fields

Configuring a security integration

Retrieve the Client ID and Secret

Enter the connection fields