SNOW-1933136: MFA caching not workig

[dandanaila]

Python version

3.9.21

Operating system and processor architecture

Linux-6.8.0-1021-aws-x86_64-with-glibc2.35

Installed packages

asn1crypto==1.5.1
boto3==1.35.71
botocore==1.35.93
certifi==2024.12.14
cffi==1.17.1
charset-normalizer==3.4.1
cryptography==44.0.0
filelock==3.16.1
idna==3.10
jmespath==1.0.1
packaging==24.2
platformdirs==4.3.6
pycparser==2.22
PyJWT==2.10.1
pyOpenSSL==24.3.0
python-dateutil==2.9.0.post0
pytz==2024.2
requests==2.32.3
ruamel.yaml==0.17.21
ruamel.yaml.clib==0.2.12
s3transfer==0.10.4
six==1.17.0
snowflake-connector-python==3.13.0
sortedcontainers==2.4.0
structlog==24.4.0
tomlkit==0.13.2
typing_extensions==4.12.2
urllib3==1.26.20

What did you do?

Followed the steps from this wiki: https://docs.snowflake.com/en/user-guide/security-mfa#using-mfa-token-caching-to-minimize-the-number-of-prompts-during-authentication-optional

In the Snowflake account run the following:

ALTER ACCOUNT SET ALLOW_CLIENT_MFA_CACHING = TRUE;
ALTER ACCOUNT SET ALLOW_ID_TOKEN = TRUE;

Python code executed:

import snowflake.connector

connection_parameters = {
  'user': '...',
  'password': '...',
  'account': '...',
  'authenticator': 'username_password_mfa',
}


def run_query():
    with snowflake.connector.connect(**connection_parameters) as con:
        cur = con.cursor()
        cur.execute("SELECT CURRENT_ACCOUNT();")
        print(cur.fetchone())


run_query()
run_query()

What did you expect to see?

The second run_query() call should not trigger a Duo push.

[sfc-gh-sghosh]

Hello @dandanaila ,

Thanks for raising the issue.
The MFA caching is not supported on Linux OS, its mentioned in documentation

Snowflake supports MFA token caching with the following drivers, connectors, and tools on macOS and Windows. This feature is not supported on Linux.

Snowflake CLI version 3.0 (or later)

ODBC driver version 2.23.0 (or later).

JDBC driver version 3.12.16 (or later).

Python Connector for Snowflake version 2.3.7 (or later).

Regards,
Sujan

[dandanaila]

@sfc-gh-sghosh are there plans to officially support it?

[dandanaila]

By the way, I was able to get it working on linux by running:

1. username + password + mfa:

connection_parameters = {
  'user': '...',
  'password': '...',
  'account': '...',
  'authenticator': 'username_password_mfa',
  'client_request_mfa_token': True,
}

2. sso:

connection_parameters = {
  'user': '...',
  'account': '...',
  'authenticator': 'externalbrowser',
  'client_store_temporary_credential': True,
}

[jontonsoup]

This fix worked for me on linux but I would prefer the default path to work. My guess is that the temporary credential way has issues that I haven't run into yet. That and I wasted an hour trying to fix it :)

[sfc-gh-sghosh]

Hi @dandanaila .

There are no plans as of now to support the Linux platform. You can use the workaround.

[apd-bbaker]

Throwing in a request for support on linux also.

[rhm-thomson]

@sfc-gh-sghosh Is this now supported on Linux with ODBC, The note in the MFA doc seems to have been removed?