OAuth Integration

You can provide configuration to Snowflake Object Lifecycle Engine for the following operation with OAuth integration:

• Manage the lifecycle of new and existing OAuth integrations
• Manage grants of OAuth integration

Usage

Classic Configuration

oauth_integrations:
  <oauth_integration-name>:
    <configuration-key>: <value>
    grants:
      <privilege>:
        - <role-name>
        - <role-name>

Data Products Configuration

- oauth_integration:
    name: <oauth_integration-name>
    <configuration-key>: <value>
    grants:
      <privilege>:
        - rel(role.<role-name>)
        - rel(role.<role-name>)

Supported parameters

The engine supports the parameters listed below.

Configuration Key	Required / Optional	Data Types and Values	Description
oauth_client	Required	String	Specifies the OAuth client type
blocked_roles_list	Optional	Set/List of String	List of roles that a user cannot explicitly consent to use after authenticating. Do not include ACCOUNTADMIN, ORGADMIN or SECURITYADMIN as they are already implicitly enforced and will cause in-place updates.
comment	Optional	String	Specifies a comment for the OAuth integration
deleted	Optional	Boolean: True enables deletion prevention, False does nothing	Specifies what objects are allowed to be deleted
enabled	Optional	Boolean	Specifies whether this OAuth integration is enabled or disabled
environment	Optional	String	Specify the environment in which the OAuth integration is managed. Regex can be provided as well
grants	Optional	Map: See Supported OAuth Integration Grants to Roles	List of Privileges and Roles to which privileges are granted on the current OAuth integration
manage_mode	Optional	Enumeration: all (default), none, grants	Configures what properties to manage for the OAuth integration. See Changing Manage Mode before changing the value.
namespacing	Optional	Enumeration: both (default), prefix, suffix, none	Specify whether prefix or suffix or both are to be added to OAuth integration name
oauth_client_type	Optional	String	Specifies the type of client being registered. Snowflake supports both confidential and public clients.
oauth_issue_refresh_tokens	Boolean	List of String	Specifies whether to allow the client to exchange a refresh token for an access token when the current access token has expired
oauth_redirect_uri	Optional	String	Specifies the client URI. After a user is authenticated, the web browser is redirected to this URI.
oauth_refresh_token_validity	Optional	Number	Specifies how long refresh tokens should be valid (in seconds). oauth_issue_refresh_tokens must be set to TRUE.
oauth_use_secondary_roles	Optional	String	Specifies whether default secondary roles set in the user properties are activated by default in the session being opened

Supported OAuth integration grants to roles

Following are the privileges you can grant to roles in the OAuth integration definition:

• ALL PRIVILEGES
• USAGE
• USE_ANY_ROLE
• OWNERSHIP

ALL PRIVILEGES handling

When you define ALL PRIVILEGES in the SOLE configuration file, you grant all the privileges listed above to roles on this object except OWNERSHIP. However, the management of ALL PRIVILEGES in SOLE differs from its handling in Snowflake. See Handling ALL PRIVILEGES in SOLE for more information.

Example

Classic Configuration

oauth_integrations:
  OAUTH_INTEGRATION_1:
    grants:
      USAGE:
        - ROLE_1
    comment: "Test OAuth 1"
    oauth_client: TABLEAU_DESKTOP
    enabled: false
    oauth_issue_refresh_tokens: false
    oauth_refresh_token_validity: 3600

Data Products Configuration

oauth_integrations:
  OAUTH_INTEGRATION_3:
    enabled: true
    oauth_client: CUSTOM
    oauth_client_type: "CONFIDENTIAL"
    oauth_redirect_uri: "https://localhost.com"
    oauth_issue_refresh_tokens: true
    oauth_refresh_token_validity: 86400
    pre_authorized_roles_list: ('MYROLE')
    blocked_roles_list: ('SYSADMIN');
    grants:
      USAGE:
        - SYSADMIN

Custom Configuration

- oauth_integration:
    name: OAUTH_INTEGRATION_1
    grants:
      USAGE:
        - rel(role.ROLE_1)
    comment: "Test OAuth 1"
    oauth_client: TABLEAU_DESKTOP
    enabled: false
    oauth_issue_refresh_tokens: false
    oauth_refresh_token_validity: 3600