SNOW-1858462: Support authentication via private_key_base64

[rd-andreas-tollkoetter]

What is the current behavior?

Not too long ago, the JDBC driver enabled a parameter called private_key_base64 (https://docs.snowflake.com/en/developer-guide/jdbc/jdbc-parameters#private-key-base64) to pass a key directly via parameter, not requiring a PEM file. As far as I can tell from experimenting and looking at the code, this isn't supported by snowflake-connector-python in any way.

What is the desired behavior?

Just like passing private_key to the connector right now, passing private_key_base64 should be a supported option.

How would this improve snowflake-connector-python?

Feature parity (at least in this aspect) with JDBC; reduces the initial barrier for setting up a connection.

References and other background

No response

[sfc-gh-dszmolka]

hi - thank you for submitting this enhancement request, the team will consider for future planning

[wesleyhillyext]

+1

We're using the PrivateKey parameter in the gosnowflake driver, and in Java using the SnowflakeBasicDataSource.setPrivateKey method and the private_key property for SnowflakeStreamingIngestClientFactory.

Having to write out a file to local disk in order to use key-pair auth with the Python connector has been slowing down our migration off the deprecated password auth.

[shawnwall]

FYI, I wanted to note it basically is possible to do this already:

    snowflake.connector.connect(
        account=...,
        database=...,
        user=...,
        private_key=private_key_der,  # Use private key instead of password
        warehouse=...,
        schema=...,
    )

where private_key_der is from:

def convert_snowflake_private_key(private_key_str: str, private_key_passphrase: str | None) -> bytes:
    """Convert a Snowflake private key from PEM or base64 format to DER format.

    :param private_key_str: The private key in PEM or base64 format
    :param private_key_passphrase: Optional passphrase for the private key
    :return: The private key in DER format
    :raises ValueError: If the private key cannot be loaded or is in an incorrect format
    """
    if private_key_str.startswith("-----BEGIN"):
        # Key is already in PEM format
        # This does not appear to work with ECS+Parameter Store, only locally with .env,
        # so we use base64 encoding instead
        private_key_bytes = private_key_str.encode("utf-8")
    else:
        # Key is base64 encoded, decode it first
        private_key_bytes = base64.b64decode(private_key_str)

    # Parse the private key
    try:
        private_key = serialization.load_pem_private_key(
            private_key_bytes,
            password=private_key_passphrase.encode("utf-8")
            if private_key_passphrase
            else None,  # Convert passphrase to bytes if it exists
        )
    except (ValueError, TypeError) as e:
        raise ValueError("Failed to load the private key. Ensure the key is in PEM format and not corrupted.") from e

    # Serialize to DER format for Snowflake
    return private_key.private_bytes(
        encoding=serialization.Encoding.DER,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption(),
    )

NOTE I've only been able to successfully have this work with the base64 approach when using something like parameterstore+ecs with env var injection, and we had to encode as a single line via:

# Base64 encode the entire private key file
base64 -w 0 -i rsa_key.p8