Snowflake authentication

Prerequisites

Depending on the authentication type you select, you need one of the following credentials:

• For Custom authentication (JDBC authentication):
  • Database host
  • Username
  • Password
  • Warehouse
  • Database schema name
  • Database name
• OAuth 2.0 Authorization code:
  • Client ID
  • Client secret
  • Database host
  • Warehouse
  • Database schema name
  • Database name
  • Role
• RSA (Key Pair Authentication & Key Pair Rotation)
  • Database host
  • Username
  • RSA private key
  • Warehouse
  • Database schema name
  • Database name

Note:

Known limitations:

• To authenticate using RSA, you must use an unencrypted RSA private key.

• Connections via AWS PrivateLink are not supported.

• Irrespective of the selected authentication method, if your Snowflake instance restricts access by IP, you must configure an allow list for the IPs used by Integration Service. For details, refer to the Configuring the firewall section from the Automation Cloud Admin guide.

Retrieving your credentials from Snowflake

To retrieve the credentials from Snowflake, take the following steps:

1. The database host is available in the URL used to connect to your Snowflake app:

   Note: The Database host format may differ depending on your account identifier type. To learn more, refer to the section on Database Host available on this page, as well as the official Snowflake documentation.
   
   

   

   
   
   For example, for the following URL https://app.snowflake.com/east-us-2.azure/za96341/dashboards, the accountID is za96341 and the region is east-us-2.azure.
   To construct a Database host you must use the format accountID.region.snowflakecomputing.com. So, for the previous URL, the constructed Database host would be za96341.east-us-2.azure.snowflakecomputing.com.

2. Once you are logged in, on the left-side menu, select Data, then Databases.

   • Database name: A list of databases is displayed:

     
     

     

     
     

   • Database schema name - Select a database to view the list of database schema names:

     
     

     

     
     

3. To retrieve the Warehouse, on the left-side menu, go to Admin > Warehouses:

   
   

   

   
   

Using the OAuth 2.0 Authorization code authentication method

Note: Only users with an ACCOUNTADMIN role can create OAuth2 credentials. By default, users with ACCOUNTADMIN, ORGADMIN, and SECURITYADMIN roles are blocked from using OAuth 2.0 authentication to create a connection. For details, refer to Snowflake OAuth authorization flow.

To create an OAuth 2.0 client for Snowflake, take the following steps:

1. Run the following query to create the OAuth integration.
   This query does not show the Client ID. You must run a second query to view the client details. Make sure to include the correct redirect URL in the query: https://cloud.uipath.com/provisioning_/callback.

   CREATE SECURITY INTEGRATION my_oauth_integration_uipath
   
      TYPE=OAUTH
      OAUTH_CLIENT= CUSTOM
      OAUTH_REDIRECT_URI='https://cloud.uipath.com/provisioning_/callback'
      OAUTH_CLIENT_TYPE='CONFIDENTIAL'
      OAUTH_ISSUE_REFRESH_TOKENS=true
      OAUTH_REFRESH_TOKEN_VALIDITY= 86400
      ENABLED=true;

2. Run the following query to view the client details. Copy the OAUTH_CLIENT_ID.

   DESCRIBE SECURITY INTEGRATION my_oauth_integration_uipath

3. Run the following query to view the client secret. Copy the OAUTH_CLIENT_SECRET.
   This query outputs two items: OAUTH_CLIENT_SECRET and OAUTH_CLIENT_SECRET_2. You must use OAUTH_CLIENT_SECRET.

   select system$show_oauth_client_secrets('MY_OAUTH_INTEGRATION_UIPATH');

For details, refer to Configure Snowflake OAuth for custom clients.

Adding the Snowflake connection

1. Select Integration Service from Automation Cloud^TM.

2. From the Connectors list, select Snowflake. You can also use the search bar to find the connector.
3. Select the Connect to Snowflake button and select your preferred authentication method.
4. Enter your required Snowflake credentials.

5. Select Connect.

6. Your connection has been added.

Permissions

Connecting allows UiPath to read, write, modify, and delete Snowflake data on your behalf.

Required roles for connecting to Snowflake

While creating a connection for Snowflake from Integration Service, the connector always selects the default role of the user, as shown in the following image.

Snowflake administrators can set up custom roles for users, because not everyone is granted administrator roles for security reasons.

The following example shows what exactly is needed in Snowflake for the Integration Service connection process to work smoothly. In this example, you create a connection using the DEAL_AMOUNT database schema and JULY_DEMO database.

The first step is to make sure that the default role, in this case SAMRAT, has USAGE privilege on both the Database (JULY_DEMO) and Database schema (DEAL_AMOUNT) in Snowflake.

A successful authentication to Snowflake is dependent on these settings. A role can always have additional privileges assigned to it by an Administrator.