Snowflake：为外部 OAuth 配置 Microsoft Azure AD - 管理员同意

Question

I am using this guide to configure Microsoft Azure AD for external OAuth in Snowflake. I'm pretty sure that I followed all the steps because tried that meticulously on three Azure subscriptions and got the same result.

Every time I got stuck at the testing procedure section where I'm supposed to send a request to Azure AD to get an access token:

curl -X POST -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \
  --data-urlencode "client_id=<OAUTH_CLIENT_ID>" \
  --data-urlencode "client_secret=<OAUTH_CLIENT_SECRET>" \
  --data-urlencode "username=<AZURE_AD_USER>" \
  --data-urlencode "password=<AZURE_AD_USER_PASSWORD>" \
  --data-urlencode "grant_type=password" \
  --data-urlencode "scope=session:role:analyst" \
  '<AZURE_AD_OAUTH_TOKEN_ENDPOINT>'

I am a subscription owner and definitely granted admin access to the session:role:analyst scope:

However, instead of the access token, I get the following response:

{
    "error": "invalid_grant",
    "error_description": "AADSTS65001: The user or administrator has not consented to use the application with ID '...' named 'Snowflake OAuth Client'. Send an interactive authorization request for this user and resource.\r\nTrace ID: ...\r\nCorrelation ID: ...\r\nTimestamp: ...",
    "error_codes": [
        65001
    ],
    "timestamp": "...",
    "trace_id": "...",
    "correlation_id": "...",
    "suberror": "consent_required"
}

Tried to grant the consent by reaching https://login.microsoftonline.com/{{tenant_id}}/adminconsent?client_id={{client_id}} and after granting the consent, got an error: AADSTS500113: No reply address is registered for the application.

Found this and added the return URL http://localhost/ (without a clear understanding of why). Granted the consent again and was redirected to http://localhost/?admin_consent=True&tenant={{tenant_id}}# which, I suppose, is fine.

But I still get AADSTS65001: The user or administrator has not consented to use the application .

Reached to Microsoft documentation and figured out that using grant_type=password is not recommended - makes sense.

Tried grant_type=client credentials:

curl --location --request GET 'https://login.microsoftonline.com/{{tenant_id}}/oauth2/v2.0/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id={{client_id}}' \
--data-urlencode 'scope=https://graph.microsoft.com/.default' \
--data-urlencode 'client_secret={{client_secret}}'

Got the access token, but attempts to connect to Snowflake with a connection string like:

connection.ConnectionString = $"account={account};host={host};authenticator=oauth;user={oauthUser};token={token};";

Throw Snowflake.Data.Client.SnowflakeDbException: 'Invalid OAuth access token. .

I suspect this is because scope=https://graph.microsoft.com/.default , but replacing it with session:scope:analyst brings this:

{
    "error": "invalid_scope",
    "error_description": "AADSTS1002012: The provided value for scope session:scope:analyst is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI).\r\nTrace ID: ...\r\nCorrelation ID: ...\r\nTimestamp: ...",
    "error_codes": [
        1002012
    ],
    "timestamp": "...",
    "trace_id": "...",
    "correlation_id": "..."
}

Since I already deviated from the official Snowflake guide, I'm asking the community for help with this issue. Thank you in in advance!

Answer 1

When obtaining an access token with the Resource Owner Password Credentials Grant flow (which is not recommended and you really shouldn't do), the resulting access token is for accessing a resource (API) on behalf of the signed-in user. In the Microsoft identity platform, access on behalf of a user requires the client application be granted at least one delegated permissions to the requested resource.

In your screenshot, we see that the permission you granted for "Snowflake OAuth Resource" is an application permission (aka "app role").

You need to do two things:

1. On the resource app's app registration, make sure you followed sub-step 10 under Step 1: Configure the OAuth Resource in Azure AD , and defined "session:scope:analyst" as a delegated permission (scope).
2. In the client's app registration, under API permissions, choose the corresponding delegated permission for the resource, and grant it.

Then, when you go to test obtaining the token, make sure the "scope" parameter is the full scope value, including the resource's identifier URI (which you defined in sub-step 9). For example, if your identifier URI is https://my.snowflake.example.com , then the "scope" value would be https://my.snowflake.example.com/session:role:analyst and your cURL request would be:

curl -X POST -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \
  --data-urlencode "client_id=<OAUTH_CLIENT_ID>" \
  --data-urlencode "client_secret=<OAUTH_CLIENT_SECRET>" \
  --data-urlencode "username=<AZURE_AD_USER>" \
  --data-urlencode "password=<AZURE_AD_USER_PASSWORD>" \
  --data-urlencode "grant_type=password" \
  --data-urlencode "scope=https://my.snowflake.example.com/session:role:analyst" \
  '<AZURE_AD_OAUTH_TOKEN_ENDPOINT>'

WARNING : The Resource Owner Password Credentials Grant flow is not recommended. I suggest reaching out to app publishers who are suggesting you use this flow. Here is Microsoft's warning on the subject :

Microsoft recommends you do not use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks which are not present in other flows. You should only use this flow when other more secure flows can't be used.

Answer 2

If the set up is still configured for "password" type grant credentials then the issue there is with the scope which should be set up on AAD and passed as follows:

**session:role-<name>**

Note, that the hyphen between role and name and it's not a colon.

In your setup, it seems to be set up and passed as:

session:role:<name>