OAuth Integration

You can provide configuration to Snowflake Object Lifecycle Engine for the following operation with OAuth integration:

• Manage the lifecycle of new and existing OAuth integrations

Usage

note

We have introduced SOLE for Data Products as a new framework for SOLE to help you easily build an ecosystem of data products. Learn more about SOLE for Data Products which is currently available as a private preview.

OAuth Integration in Current Configuration

oauth_integrations:
  <oauth_integration-name>:
    <configuration-key>: <value>
    grants:
      <privilege>:
        - <role-name>
        - <role-name>

OAuth Integration in SOLE for Data Products

- oauth_integration:
    name: <oauth_integration-name>
    <configuration-key>: <value>
    grants:
      <privilege>:
        - rel(role.<role-name>)
        - rel(role.<role-name>)

Supported parameters

The engine supports the parameters listed below.

Configuration Key	Required / Optional	Data Types and Values	Description
oauth_client	Required	String	Specifies the OAuth client type
blocked_roles_list	Optional	Set/List of String	List of roles that a user cannot explicitly consent to use after authenticating. Do not include ACCOUNTADMIN, ORGADMIN or SECURITYADMIN as they are already implicitly enforced and will cause in-place updates.
comment	Optional	String	Specifies a comment for the OAuth integration
deleted	Optional	Boolean: True enables deletion prevention, False does nothing	Specifies what objects are allowed to be deleted
enabled	Optional	Boolean	Specifies whether this OAuth integration is enabled or disabled
environment	Optional	String	Specify the environment in which the OAuth integration is managed. Regex can be provided as well
grants	Optional	Map: See Supported OAuth Integration Grants to Roles	List of Privileges and Roles to which privileges are granted on the current OAuth integration
manage_mode	Optional	Enumeration: all (default), none, grants	Configures what properties to manage for the OAuth integration. See Changing Manage Mode before changing the value.
namespacing	Optional	Enumeration: both (default), prefix, suffix, none	Specify whether prefix or suffix or both are to be added to OAuth integration name
oauth_issue_refresh_tokens	Boolean	List of String	Specifies whether to allow the client to exchange a refresh token for an access token when the current access token has expired
oauth_refresh_token_validity	Optional	Number	Specifies how long refresh tokens should be valid (in seconds). oauth_issue_refresh_tokens must be set to TRUE.
oauth_use_secondary_roles	Optional	String	Specifies whether default secondary roles set in the user properties are activated by default in the session being opened

Supported OAuth integration grants to roles

Following are the privileges you can grant to roles in the OAuth integration definition:

• ALL PRIVILEGES
• USAGE
• USE_ANY_ROLE
• OWNERSHIP

Example

OAuth Integration in Current Configuration

oauth_integrations:
  OAUTH_INTEGRATION_1:
    grants:
      USAGE:
        - ROLE_1
    comment: "Test OAuth 1"
    oauth_client: TABLEAU_DESKTOP
    enabled: false
    oauth_issue_refresh_tokens: false
    oauth_refresh_token_validity: 3600

OAuth Integration in SOLE for Data Products

- oauth_integration:
    name: OAUTH_INTEGRATION_1
    grants:
      USAGE:
        - rel(role.ROLE_1)
    comment: "Test OAuth 1"
    oauth_client: TABLEAU_DESKTOP
    enabled: false
    oauth_issue_refresh_tokens: false
    oauth_refresh_token_validity: 3600