Skip to main content
For authenticating Snowflake users directly through Snowflake, see Snowflake native OAuth.
Snowflake External OAuth allows each Omni user to authenticate to Snowflake using their own identity through an external identity provider instead of Snowflake’s built-in OAuth server. Each user’s queries run under their own Snowflake role and session, so Snowflake’s row-level security and role restrictions apply automatically. Looking for another IdP? Guides for Microsoft Entra ID (Azure AD) and Ping Identity are coming soon.

​
Requirements

To follow the steps in this guide, you’ll need:
  • Permissions in Okta that allow you to create an app integration and authorization server
  • In Omni:
    • To have the OAuth database connection feature enabled
    • Organization Admin permissions
    • An existing Snowflake connection. Refer to Connecting a Snowflake database before continuing.
  • In Snowflake:
    • ACCOUNTADMIN or SECURITYADMIN privileges to create a security integration
    • A service account with access to all schemas and tables you want to use in Omni. This is required even when OAuth is enabled, because Omni uses the service account to build the model.
    • To assign regular user roles to your Snowflake users. Snowflake blocks ACCOUNTADMIN, ORGADMIN, and SECURITYADMIN from external OAuth authentication by default.
Before continuing, review the OAuth limitations.

​
Setup

1

Create an Okta application

  1. In the Okta admin console, navigate to Applications > Applications.
  2. Click Create App Integration.
  3. Select OIDC - OpenID Connect as the sign-in method and Web Application as the application type.
  4. Give it a descriptive name (e.g., Omni Snowflake External OAuth).
  5. Under Grant type, enable Refresh Token in addition to Authorization Code.
  6. In Sign-in redirect URIs, add the Omni callback: https://callbacks.<your-omni-domain>/callback/oauth
    For vanity-domain embeds: If you’re using OAuth with vanity-domain embeds, also add https://<your-vanity-domain>/oauth/callback to Sign-in redirect URIs. Replace <your-vanity-domain> with your vanity domain (e.g., omni.myapp.com).
  7. Save the app.
  8. Copy the Client ID and Client Secret — you’ll need these in Omni.
2

Create an Okta authorization server

  1. In Okta, navigate to Security > API and click Add Authorization Server.
  2. Set the Audience to your Snowflake account URL (e.g., https://<account>.snowflakecomputing.com).
  3. Open the server’s Metadata URI and note the following values — you’ll need them for both Snowflake and Omni:
    • Issuer (issuer)
    • Authorization endpoint (authorization_endpoint)
    • Token endpoint (token_endpoint)
    • JWK Set URI (jwks_uri)
  4. Add a Scope named SESSION:ROLE-ANY. This allows the token to work with any role the user holds in Snowflake.
  5. Under Access Policies, create a policy that assigns your app to this authorization server.
  6. Add a rule with appropriate token lifetimes — Okta’s defaults (1-hour access token, 90-day refresh token) are reasonable starting points.
3

Create a Snowflake security integration

Run this in Snowflake as ACCOUNTADMIN or SECURITYADMIN, substituting values from your Okta metadata URI.
User mapping: The email_address value is used to map Okta users to Snowflake. Each user’s Okta email must exactly match the LOGIN_NAME or EMAIL on their Snowflake user record. Verify this before going live.
CREATE SECURITY INTEGRATION omni_external_oauth
  TYPE = EXTERNAL_OAUTH
  ENABLED = TRUE
  EXTERNAL_OAUTH_TYPE = OKTA
  EXTERNAL_OAUTH_ISSUER = '<issuer from Okta metadata>'
  EXTERNAL_OAUTH_JWS_KEYS_URL = '<jwks_uri from Okta metadata>'
  EXTERNAL_OAUTH_AUDIENCE_LIST = ('<your Snowflake account URL>')
  EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub'
  EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'email_address'
  EXTERNAL_OAUTH_ANY_ROLE_MODE = 'ENABLE';
4

Configure the connection in Omni

You must still configure a service account on this connection. Omni uses the service account to build the model, which provides the foundation for all user queries.
This guide assumes you have an existing Snowflake connection in Omni. If you don’t, refer to Connecting a Snowflake database for more information.
  1. In Omni, navigate to Settings > Connections and click on the Snowflake connection you want to use.
  2. Under Authentication type, select External OAuth User Authentication.
  3. Fill in the fields as follows:
    • Authorization URL - Enter the authorization_endpoint from Okta metadata
    • Token URL - Enter the token_endpoint from Okta metadata
    • OAuth Client ID - Enter the Client ID from your Okta app
    • OAuth Client Secret - Enter the Client Secret from your Okta app
    • Audience - Leave blank
    • Warehouse - Optional: Leave blank to use each user’s DEFAULT_WAREHOUSE from Snowflake. This enables per-user warehouse routing for organizations using role-to-warehouse mappings in Snowflake for cost attribution. Users must have an assigned default warehouse to use this feature. Otherwise, users without a default warehouse will receive a No active warehouse error when they attempt to run queries in Omni.
  4. Save the connection.
5

Verify the user experience

After saving, each Omni user who wants to query this connection will need to authorize once through the OAuth flow. They’ll be redirected to Okta to sign in, then redirected back to Omni. After that, Omni will automatically refresh their token in the background.
Running into issues? See the Troubleshooting Snowflake OAuth for help with diagnosing and resolving common Snowflake OAuth problems.

​
Next steps

To ensure database permissions align with what users see in Omni, we recommend implementing:
  • Access grants to control which fields and tables are visible to each user in the model and field browser
  • Content permissions to control which dashboards and documents users can access