require SF_ENABLE_EXPERIMENTAL_AUTHENTICATION to be set to true (#2261)

Author: sfc-gh-mkubik

src/snowflake/connector/connection.py

@@ -2235,13 +2235,13 @@ def is_valid(self) -> bool:
             return False
 
     def _check_experimental_authentication_flag(self) -> None:
-        if ENV_VAR_EXPERIMENTAL_AUTHENTICATION not in os.environ:
+        if os.getenv(ENV_VAR_EXPERIMENTAL_AUTHENTICATION, "false").lower() != "true":
             Error.errorhandler_wrapper(
                 self,
                 None,
                 ProgrammingError,
                 {
-                    "msg": f"Please set the '{ENV_VAR_EXPERIMENTAL_AUTHENTICATION}' environment variable to use the '{self._authenticator}' authenticator.",
+                    "msg": f"Please set the '{ENV_VAR_EXPERIMENTAL_AUTHENTICATION}' environment variable true to use the '{self._authenticator}' authenticator.",
                     "errno": ER_EXPERIMENTAL_AUTHENTICATION_NOT_SUPPORTED,
                 },
             )

test/unit/test_connection.py

@@ -626,7 +626,7 @@ def test_cannot_set_wlid_authenticator_without_env_variable(mock_post_requests):
             account="account", authenticator="WORKLOAD_IDENTITY"
         )
     assert (
-        "Please set the 'SF_ENABLE_EXPERIMENTAL_AUTHENTICATION' environment variable to use the 'WORKLOAD_IDENTITY' authenticator"
+        "Please set the 'SF_ENABLE_EXPERIMENTAL_AUTHENTICATION' environment variable true to use the 'WORKLOAD_IDENTITY' authenticator"
         in str(excinfo.value)
     )
 
@@ -636,7 +636,7 @@ def test_connection_params_are_plumbed_into_authbyworkloadidentity(monkeypatch):
         m.setattr(
             "snowflake.connector.SnowflakeConnection._authenticate", lambda *_: None
         )
-        m.setenv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION", "")  # Can be set to anything.
+        m.setenv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION", "true")
 
         conn = snowflake.connector.connect(
             account="my_account_1",
@@ -678,7 +678,7 @@ def test_toml_connection_params_are_plumbed_into_authbyworkloadidentity(
         m.setattr(
             "snowflake.connector.SnowflakeConnection._authenticate", lambda *_: None
         )
-        m.setenv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION", "")
+        m.setenv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION", "true")
 
         conn = snowflake.connector.connect(connections_file_path=connections_file)
         assert conn.auth_class.provider == AttestationProvider.OIDC

test/unit/test_oauth_token.py

@@ -706,3 +706,24 @@ def test_auth_is_experimental(
             account="testAccount",
             authenticator=authenticator,
         )
+
+
+@pytest.mark.skipolddriver
+@pytest.mark.skipolddriver
+@pytest.mark.parametrize(
+    "authenticator", ["OAUTH_AUTHORIZATION_CODE", "OAUTH_CLIENT_CREDENTIALS"]
+)
+def test_auth_experimental_when_variable_set_to_false(
+    authenticator,
+    monkeypatch,
+) -> None:
+    monkeypatch.setenv("SF_ENABLE_EXPERIMENTAL_AUTHENTICATION", "false")
+    with pytest.raises(
+        snowflake.connector.ProgrammingError,
+        match=r"SF_ENABLE_EXPERIMENTAL_AUTHENTICATION",
+    ):
+        snowflake.connector.connect(
+            user="testUser",
+            account="testAccount",
+            authenticator="OAUTH_CLIENT_CREDENTIALS",
+        )