> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting Snowflake OAuth

> Diagnose and resolve common issues with Omni's Snowflake OAuth integration.

Use this guide to diagnose common issues with Omni's Snowflake OAuth integration. Each scenario describes what you're seeing, why it happens, and how to fix it.

## Users can't authenticate with Entra ID or Okta

<Note>
  This section is applicable if you're using [Snowflake External OAuth](https://docs.snowflake.com/en/user-guide/oauth-ext-overview).
</Note>

<Steps>
  <Step title="What you're seeing" icon="eye">
    Users are unable to use Entra ID or Okta to authenticate to Snowflake.
  </Step>

  <Step title="Why it happens" icon="question">
    Authentication failures are commonly caused by mismatches between the user identifiers in the Identity Provider (IdP) and Snowflake. As identifiers are case-sensitive, a mismatch could be caused by a difference in casing. For example, `blobby` versus `Blobby`.
  </Step>

  <Step title="How to fix it" icon="hammer">
    Verify that each user's IdP identifier exactly matches the required value in Snowflake, including casing.

    | Your IdP | User's IdP identifier    | Snowflake value         |
    | -------- | ------------------------ | ----------------------- |
    | Entra ID | UPN (User Principal Name | `LOGIN_NAME`            |
    | Okta     | Email                    | `LOGIN_NAME` or `EMAIL` |
  </Step>
</Steps>

## Frequent re-authentication prompts

<Steps>
  <Step title="What you're seeing" icon="eye">
    Users authenticated to Snowflake using OAuth frequently receive prompts to re-authenticate.
  </Step>

  <Step title="Why it happens" icon="question">
    This issue is typically caused by insufficient refresh token lifetimes or an incorrectly configured Snowflake security integration.
  </Step>

  <Step title="How to fix it" icon="hammer">
    Verify that:

    * The refresh token lifetime in your IdP is sufficient. Omni recommends 90 days.
    * The Snowflake security integration is correctly configured with the IdP's token endpoint. See the OAuth setup guide for your IdP ([Entra ID](/connect-data/oauth/snowflake/external-entra#create-snowflake-integration), [Okta](/connect-data/oauth/snowflake/external-okta#create-a-snowflake-security-integration)) for more information.
  </Step>
</Steps>

## 'No default warehouse' errors when querying in Omni

<Steps>
  <Step title="What you're seeing" icon="eye">
    Users receive a `No active warehouse` error when they try to run queries against Snowflake in Omni.
  </Step>

  <Step title="Why it happens" icon="question">
    This occurs when both of the following are true:

    1. The **Warehouse** field on the Omni Snowflake connection is left blank
    2. An Omni user who authenticated to Snoflake through OAuth doesn't have an assigned `DEFAULT_WAREHOUSE`

    When the **Warehouse** field is left blank on a Snowflake connection, Omni uses each user's `DEFAULT_WAREHOUSE` from Snowflake. If the user doesn't have an assigned `DEFAULT_WAREHOUSE`, Snowflake can't route the query to the correct warehouse.
  </Step>

  <Step title="How to fix it" icon="hammer">
    In Snowflake, verify that all users who need to query the database from Omni have an assigned `DEFAULT_WAREHOUSE`. Users with the required Snowflake permissions can run [`SHOW USERS`](https://docs.snowflake.com/en/sql-reference/sql/show-users) to check if a user has a `DEFAULT_WAREHOUSE` configured:

    ```sql theme={null}
    show users;
    ```

    The output of `SHOW USERS` will include a `default_warehouse` column. If this column is blank, you'll need use `ALTER USER` to assign a warehouse:

    ```sql theme={null}
    alter user <user_name> set default_warehouse = '<warehouse>';
    ```

    Alternatively, if you're unable or don't want to assign a `DEFAULT_WAREHOUSE` to users, specify a **Warehouse** on the Snowflake connection in Omni.
  </Step>
</Steps>