snowflake user creation - use public key (#827)

* snowflake user creation - use public key

* small fixes

* remove wrong change

Author: haritamar

macros/commands/create_elementary_user.sql

@@ -1,22 +1,36 @@
-{% macro create_elementary_user(user="elementary", password=none, role="ELEMENTARY_ROLE") %}
-  {% if password is none %}
-    {% set password = elementary.generate_password() %}
-  {% endif %}
-  {% set profile_parameters = elementary.generate_elementary_profile_args(overwrite_values={
+{% macro create_elementary_user(user="elementary", password=none, role="ELEMENTARY_ROLE", public_key=none) %}
+  {% set auth_method = elementary.get_auth_method() %}
+  {% set parameter_values = {
     "user": user,
-    "password": password,
     "role": role
-  }) %}
-  {% set profile_parameters_dict = {} %}
+  } %}
+
+  {% if auth_method == "password" %}
+    {% if password is none %}
+      {% do parameter_values.update({"password": elementary.generate_password()}) %}
+    {% else %}
+      {% do parameter_values.update({"password": password}) %}
+    {% endif %}
+  {% elif auth_method == "keypair" %}
+    {%- if public_key is none or public_key == "" -%}
+      {%- do exceptions.raise_compiler_error("ERROR: A public key must be provided to generate a Snowflake user!") -%}
+    {%- endif -%}
+    {% do parameter_values.update({"public_key": public_key}) %}
+  {% endif %}
+
+  {# Unify the parameters above with auto-generated profile parameters, to get everything
+     we need to create the user. #}
+  {% set profile_parameters = elementary.generate_elementary_profile_args(overwrite_values=parameter_values) %}  
   {% for parameter in profile_parameters %}
-    {% set profile_parameters_dict = profile_parameters_dict.update({parameter["name"]: parameter["value"]}) %}
+    {% do parameter_values.update({parameter["name"]: parameter["value"]}) %}
   {% endfor %}
-  {% set profile_creation_query = elementary.get_profile_creation_query(profile_parameters_dict) %}
+
+  {% set profile_creation_query = elementary.get_user_creation_query(parameter_values) %}
   {% do print("\nPlease run the following query in your database to create the Elementary user:\n" ~ profile_creation_query) %}
   {% do print("\nAfter that, use the following parameters when configuring your environment\n") %}
   {% for parameter in profile_parameters %}
-    {% if parameter["name"] != "threads" %}  {# threads is not a parameter for the environment #}
-      {% do print(parameter["name"]|capitalize ~ ": " ~ parameter["value"]) %}
+    {% if parameter["name"] not in ["threads", "public_key"] %}
+      {% do print(parameter["name"]|capitalize|replace('_', ' ') ~ ": " ~ parameter["value"]) %}
     {% endif %}
   {% endfor %}
 {% endmacro %}
@@ -31,3 +45,16 @@
   {% endfor %}
   {% do return(ns.password) %}
 {% endmacro %}
+
+
+{% macro get_auth_method() %}
+  {% do return(adapter.dispatch("get_auth_method", "elementary")()) %}
+{% endmacro %}
+
+{% macro default__get_auth_method() %}
+  {% do return("password") %}
+{% endmacro %}
+
+{% macro snowflake__get_auth_method() %}
+  {% do return("keypair") %}
+{% endmacro %}

macros/utils/cross_db_utils/generate_elementary_profile_args.sql

@@ -27,7 +27,8 @@
     _parameter("type", target.type),
     _parameter("account", target.account),
     _parameter("user", target.user),
-    _parameter("password", "<PASSWORD>"),
+    _parameter("private_key", "<contents of generated private key>"),
+    _parameter("private_key_passphrase", "<passphrase for the private key, if key is encrypted>"),
     _parameter("role", target.role),
     _parameter("warehouse", target.warehouse),
     _parameter("database", elementary_database),

…_db_utils/get_profile_creation_query.sql …oss_db_utils/get_user_creation_query.sqlmacros/utils/cross_db_utils/get_profile_creation_query.sql renamed to macros/utils/cross_db_utils/get_user_creation_query.sql macros/utils/cross_db_utils/get_profile_creation_query.sql renamed to macros/utils/cross_db_utils/get_user_creation_query.sql

@@ -1,22 +1,26 @@
-{% macro get_profile_creation_query(parameters) %}
-  {% do return(adapter.dispatch("get_profile_creation_query", "elementary")(parameters)) %}
+{% macro get_user_creation_query(parameters) %}
+  {% do return(adapter.dispatch("get_user_creation_query", "elementary")(parameters)) %}
 {% endmacro %}
 
 
-{% macro snowflake__get_profile_creation_query(parameters) %}
+{% macro snowflake__get_user_creation_query(parameters) %}
+{%- set normalized_public_key = parameters["public_key"]
+            .replace('-----BEGIN PUBLIC KEY-----', '')
+            .replace('-----END PUBLIC KEY-----', '')
+            .strip() -%}
+
 -- Set credentials as variables
 SET elementary_database = '{{ parameters["database"] }}';
 SET elementary_schema = '{{ parameters["schema"] }}';
 SET elementary_warehouse = '{{ parameters["warehouse"] }}';
 SET elementary_role = '{{ parameters["role"] }}';
 SET elementary_username = '{{ parameters["user"] }}';
-SET elementary_password = '{{ parameters["password"] }}';
 
 -- Account admin role required to set up permissions below
 USE ROLE ACCOUNTADMIN;
 
 -- Create elementary user and role
-CREATE OR REPLACE USER IDENTIFIER($elementary_username) PASSWORD = $elementary_password;
+CREATE OR REPLACE USER IDENTIFIER($elementary_username) TYPE = SERVICE RSA_PUBLIC_KEY = '{{ normalized_public_key }}';
 CREATE OR REPLACE ROLE IDENTIFIER($elementary_role);
 GRANT ROLE IDENTIFIER($elementary_role) TO USER IDENTIFIER($elementary_username);
 
@@ -39,7 +43,7 @@ GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE IDENTIFIER($elementary_r
 {% endmacro %}
 
 
-{% macro redshift__get_profile_creation_query(parameters) %}
+{% macro redshift__get_user_creation_query(parameters) %}
 -- Create redshift user with unrestricted access to query history (allows Elementary to see queries generated by
 -- any user)
 CREATE USER {{ parameters["user"] }} WITH PASSWORD '{{ parameters["password"] }}' SYSLOG ACCESS UNRESTRICTED;
@@ -81,7 +85,7 @@ CALL elementary_grant_usage_on_all_schemas('{{ parameters["user"] }}');
 {% endmacro %}
 
 
-{% macro postgres__get_profile_creation_query(parameters) %}
+{% macro postgres__get_user_creation_query(parameters) %}
 -- Create postgres user
 CREATE USER {{ parameters["user"] }} WITH PASSWORD '{{ parameters["password"] }}';
 
@@ -92,7 +96,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA {{ parameters["schema"] }} GRANT SELECT ON TA
 {% endmacro %}
 
 
-{% macro clickhouse__get_profile_creation_query(parameters) %}
+{% macro clickhouse__get_user_creation_query(parameters) %}
 -- Create clickhouse user
 CREATE USER {{ parameters["user"] }} identified by '{{ parameters["password"] }}';
 
@@ -103,6 +107,6 @@ grant create table on {{ parameters["schema"] }}.* to {{ parameters["user"] }}
 
 
 {# Databricks, BigQuery, Spark #}
-{% macro default__get_profile_creation_query(parameters) %}
+{% macro default__get_user_creation_query(parameters) %}
   {% do exceptions.raise_compiler_error('User creation not supported through sql using ' ~ target.type) %}
 {% endmacro %}