Possible to login to Snowflake using SSO without a user account or default role?

user_3300415 0
Viewed 597

I'm working on improving the user experience for our org when logging into snowflake. We have adfs sso enabled and are provisioning mapping users to roles using azure ad. I had a colleague attempt to sign in with SSO who didn't have a user account created in snowflake and they were greeted with

"The signed in user <user@email.com> is not assigned to a role for the application (Snowflake)".

My question is, is it possible to have users sign into snowflake without being mapped to a default role, perhaps only have the public role assigned, and without being synced with azure ad.

If it is, i'd appreciate any pointers to documentation i can reference. The goal is to get all users that can SSO, to by default be able to login

snowflake-cloud-data-platform
2 Answers

AD group syncing occurs every 40 minutes in Microsoft, and I don't believe it's possible to force a sync or change this time frame. In addition, like the OP mentioned Snowflake cannot connect to an on-prem ADFS server so all users must be in Azure AD.

AD group syncing is somewhat configurable via the "Scope" (see Step 15 of this tutorial)

If your Scope is set to "Sync only assigned users and groups", you can either

  1. Change the scope to "Sync all users and groups" (may cause issues if you don't want to import all this data into Snowflake)

or

  1. Confirm that your desired users' AD group is one of those assigned to be synced to Snowflake (requires manually assigning these users, or that all of these users are part of the same AD group that you choose to sync to Snowflake).
user_132382720

By seeing the error its not allowing user who don't have appropriate role for the application.

In these why can't we create generic stored procedure to assign default role and instance to new user based on the group they belong to.! Each time if we add any new user then we have to run stored procedure to assign default role and object prior to his login to snowflake.

user_121116990
Related