[FEAT] Snowflake External OAuth: Allow access tokens when authenticating with profiles.yml

[erlendhbarstad]

Is your feature request related to a problem? Please describe.
When authenticating using oauth to Snowflake with dbt-fusion from VS Code, you are limited to use the Security Integration type Snowflake OAuth. Thus, the following values in your profiles.yml file are required:

• oauth_client_secret
• oauth_client_id
• token (refresh token)

This is also described in your code here.

With the current platform setup we have combined with our security requirements, we like dbt-fusion to support external oauth in Snowflake. Hence, it will be possible to only use access tokens directly to Snowflake in our profiles.yml file. See examples down below.

Is your feature request related to a particular component of the dbt Fusion Engine

• CLI Features
• Adapter or Database Driver Features
• SQL Understanding Features
• VS Code extension

Describe the solution you'd like
When using dbt Core, you have the possibility to choose whether to use an access token or client ID, secret, and refresh token. The solution is described here.

Preferred profiles.yml when not adding client id+secret:

      type: snowflake
      schema: DBT
      database: DEV
      role: my_role
      authenticator: oauth
      token: **my_access_token_123**
      ...

The current profiles.yml:

     type: snowflake
     schema: DBT
     database: DEV
     role: my_role
     authenticator: oauth
     oauth_client_id: '123'
     oauth_client_secret: '123'
     token: 'my_refresh_token_123'
     ...

Describe alternatives you've considered
Move our developers from an automatic workflow with a pre defined profiles.yml to external browser authentication.

[boxysean]

Renamed to better describe, as I usually think of this as Snowflake External OAuth, which is also available with dbt Core here.

[boxysean]

Also @dbeatty10 should this be classified as a bug/regression instead? Since this works in dbt Core?

[imre-kerr-sb1]

As I mentioned on slack @boxysean, this seems to be fixed now with authenticator: jwt.

dbt-fusion/crates/dbt-auth/src/snowflake/mod.rs

Lines 426 to 440 in 3a9aa79

	} else if value == "jwt" {
	if let Some(token) = config.maybe_get_str("token")? {
	builder.with_named_option(snowflake::AUTH_TOKEN, token)?;
	} else {
	Err(AuthError::config(
	"Field token: not found. Required for authenticator jwt.",
	))?
	}
	builder
	.with_named_option(snowflake::CLIENT_STORE_TEMP_CREDS, "true")?;
	builder.with_named_option(
	snowflake::AUTH_TYPE,
	snowflake::auth_type::OAUTH,
	)
	} else if value == "username_password_mfa" {

All that's missing is an update to this error message:

dbt-fusion/crates/dbt-auth/src/snowflake/mod.rs

Line 448 in 3a9aa79

"'{value}' for authenticator is not supported. If using authenticator, it must be set to exactly one of {{'externalbrowser', 'oauth', 'username_password_mfa'}}."

[amychen1776]

@VersusFacit as our Auth expert - perhaps you can adjust this one quickly with a better error message?

[fa-assistant]

🧹 Stale Issue Detected

This issue has had no meaningful activity for 180 days.

If this is still relevant, please:

• Comment with an update, or
• Add the cleanup/keep label to exempt it from future cleanup scans.

If no action is taken within 30 days, this issue will be scheduled for auto-close with a 7-day grace period.

cc @VersusFacit — as assignee(s), can you confirm whether this is still active?

---

This notice was posted by the Fusion Issue Cleanup workflow.

[eliasdefaria]

Closing as this is completed