Skip to content

SAML-based Single Sign-On for Snowflake (SSO)

SAML-based SSO for Snowflake is supported by Satori in both the native and the proxy-based integrations. When using the proxy-based integration, you should configure your Identity Provider (IdP) to route users to the Satori-generated hostname for Snowflake, instead of the original Snowflake hostname.

Some IdPs, such as Okta or OneLogin, allow you to route users directly to Satori with minimal changes. In other IdPs, this option is not available, and a different setup is required to establish SSO. Follow the instructions according to your IdP vendor.

IdPs Supporting Direct Routing to Satori

IdPs that support direct routing of users to Satori enable you to change the URL users are redirected to without changing the underlying SAML message. This enables Satori to transfer the SAML message directly to Snowflake.

Okta

Create a new SAML 2.0 app for Snowflake. You cannot use the built-in Snowflake app for Okta, because it doesn’t expose the necessary configuration options. However, you should still use the Snowflake app for SCIM-based provisioning (if applicable).

Most customers would have two Okta apps:

  1. The Snowflake built-in app - for SCIM-based provisioning. This app should not be visible to users.
  2. A new SAML 2.0 app - for SAML-based SSO. This app should be visible to users.

Perform the following steps to configure the new SAML 2.0 app:

  1. Go to the Applications view in the Okta admin console
  2. Select Create New App and choose SAML 2.0
  3. Enter app name and additional details like logo, etc.
  4. In the General section in the SAML Settings, go to the Single Sign-On URL input field and enter the Snowflake login URL with your Satori generated hostname. For example: https://abc123.us-east1.a.p0.satoricyber.net/fed/login
  5. Uncheck the Use this for Recipient URL and Destination URL option
  6. Enter the Snowflake original login URL in the following fields: Recipient URL, Destination URL, Audience URI (SP Identity ID). For example: https://abc123.us-east1.snowflakecomputing.com/fed/login
  7. Complete the rest of the fields and click Finish

Screenshot

OneLogin

Perform the following steps to configure OneLogin:

  1. Go to the Applications view in the OneLogin console.
  2. Select Add App and select the SAML Custom Connector (Advanced) application.
  3. Provide a unique name, description and add a logo for the application and click Save.
  4. Select the Configuration tab.
  5. Enter your original Snowflake hostname in the following fields: Audience (EntityID), Recipient and ACS (Consumer) URL Validator. For example: https://abc123.us-east1.snowflakecomputing.com/fed/login.
  6. Enter the Satori hostname in the ACS (Consumer) URL field, for example: https://abc123.us-east1.a.p0.satoricyber.net/fed/login.
  7. Go to the SSO tab, select the SHA-256 option in the SAML Signature Algorithm field.

Screenshot

IdPs Without Support for Direct Routing to Satori

IdPs that do not support direct routing of users to Satori do not enable you to change the URL users are redirected to without changing the underlying SAML message. To overcome this issue, Satori rewrites the SAML message to ensure it is trusted by Snowflake.

The setup involves a two-step trust, and is configured in the SAML Proxy Settings tab of the data store settings page:

  1. Use the Configure Trust Between Your IdP and Satori section to configure trust between your IdP and Satori
  2. Use the Configure Trust Between Satori and Snowflake section to configure trust between Satori and Snowflake

Screenshot

Microsoft Entra ID

When using Entra ID as the Snowflake SAML Identity Provider, Satori acts as a SAML proxy between Entra ID and Snowflake. Perform the following steps to configure the trust relationship between Entra ID and Satori.

  1. Go to the Satori management console.
  2. Select the Snowflake data store to configure the integration for, and navigate to the SAML Proxy Settings tab.
  3. In a new browser window, go to your Entra ID console and access the Enterprise Application view.
  4. Select the application you use to enable access to a Satori-protected data store.
  5. Select the Single Sign-On view and press Edit in the Basic SAML Configuration section.
  6. Change the Identifier (Entity ID) field to the value of the Satori Identifier (Entity ID), as shown in the Satori management console. For example, from https://abc123.us-east-1.snowflakecomputing.com/ to https://abc123.us-east-1.a.p0.satoricyber.net.
  7. Change the Reply URL (Assertion Consumer Service URL) field to the value of the Satori Reply URL (Assertion Consumer Service URL) as shown in the Satori management console. For example, from https://abc123.us-east-1.snowflakecomputing.com/fed/login to https://abc123.us-east-1.a.p0.satoricyber.net/fed/login.
  8. In the SAML Signing Certificate section, download the Certificate (Base64) file.
  9. Upload the certificate file to the Satori management console in the SAML Signing Certificate field.
  10. Copy the Login URL and Entra ID Identifier fields from the Set up section in Entra ID.
  11. Update the Login URL and IdP Identifier fields in the Satori management console using the values you copied in the previous step.

Configure Snowflake

After a SAML application has been configured in the Identity Provider, configure Snowflake to trust the new SAML application. See the Snowflake documentation for reference.

When using an IdP with direct routing to Satori, configure Snowflake to trust the SAML application in the IdP. For other IdP, configure Snowflake to trust Satori as the IdP, by using the information and certificate in the Configure Trust Between Satori and Snowflake section of the SAML Proxy Settings tab.

Please note that when updating existing SAML-based SSO integration in Snowflake, access to Snowflake via an existing application might be disabled.