Users can’t authenticate with Entra ID or Okta
This section is applicable if you’re using Snowflake External OAuth.
What you're seeing
Users are unable to use Entra ID or Okta to authenticate to Snowflake.
Why it happens
Authentication failures are commonly caused by mismatches between the user identifiers in the Identity Provider (IdP) and Snowflake. As identifiers are case-sensitive, a mismatch could be caused by a difference in casing. For example,
blobby versus Blobby.How to fix it
Verify that each user’s IdP identifier exactly matches the required value in Snowflake, including casing.
Frequent re-authentication prompts
What you're seeing
Users authenticated to Snowflake using OAuth frequently receive prompts to re-authenticate.
Why it happens
This issue is typically caused by insufficient refresh token lifetimes or an incorrectly configured Snowflake security integration.
‘Authentication Error’ after authenticating with Snowflake
This section is applicable if you’re using native Snowflake OAuth.
What you're seeing
After a user signs in to Snowflake, the OAuth callback page in Omni (
/oauth/callback) displays an Authentication Error with the message Internal Server Error. No specific error code is provided.Why it happens
Your Snowflake account uses a network policy that restricts access by IP address, and the policy doesn’t allow Omni’s IP addresses on the OAuth security integration. Network policies can be applied at both the account level and the security integration level, and the integration may need its own policy even if the account-level policy already allows Omni.
How to fix it
- Add Omni’s IP addresses to a network policy in Snowflake. The IP addresses are listed on the connection’s page, accessed by navigating to Settings > Connections and clicking the connection.
-
Apply the network policy to the security integration:
- Have the user try authenticating again.
‘No default warehouse’ errors when querying in Omni
What you're seeing
Users receive a
No active warehouse error when they try to run queries against Snowflake in Omni.Why it happens
This occurs when both of the following are true:
- The Warehouse field on the Omni Snowflake connection is left blank
- An Omni user who authenticated to Snowflake through OAuth doesn’t have an assigned
DEFAULT_WAREHOUSE
DEFAULT_WAREHOUSE from Snowflake. If the user doesn’t have an assigned DEFAULT_WAREHOUSE, Snowflake can’t route the query to the correct warehouse.How to fix it
In Snowflake, verify that all users who need to query the database from Omni have an assigned The output of Alternatively, if you’re unable or don’t want to assign a
DEFAULT_WAREHOUSE. Users with the required Snowflake permissions can run SHOW USERS to check if a user has a DEFAULT_WAREHOUSE configured:SHOW USERS will include a default_warehouse column. If this column is blank, you’ll need to use ALTER USER to assign a warehouse:DEFAULT_WAREHOUSE to users, specify a Warehouse on the Snowflake connection in Omni.‘Default role is not granted to this user’ errors
What you're seeing
Users receive a Snowflake error like the following when they run queries in Omni:
Why it happens
The user’s
DEFAULT_ROLE in Snowflake was changed, or the role was revoked from them, after they authenticated with OAuth. Omni continues to use the existing OAuth session, which still references the old role.How to fix it
Ask the user to disconnect their OAuth session and re-authenticate:
- In Omni, open your user profile.
- In the Database Authentication Sessions section, click Log out next to the Snowflake connection.
- Run a query against the Snowflake connection. Omni prompts you to authenticate with Snowflake again, which creates a new session with your current default role.
DEFAULT_ROLE: