# SailPoint Snowflake Connector Documentation > Snowflake Connector Documentation # Documentation # Connecting SailPoint and Snowflake To connect SailPoint with Snowflake, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 6. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 6. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Provide the information required to connect and interact with the source. You can use the following commands to query the Snowflake system to find the URL, Organization, and Account information: ```text USE ROLE ORGADMIN; SHOW ORGANIZATION ACCOUNTS; ``` > [!NOTE] > > **Screenshot** > > [![alt text]()]() [![alt text]()]() > [!NOTE] > > You can use the following commands to query the Snowflake system to find the **Base URL**, **Organization**, and **Account** information: > > Use the following command to query the Snowflake server's version: > > ```text > SELECT CURRENT_VERSION(); > ``` > > For Snowflake servers with version 9.17.0 or later, use the following command: > > ```text > SHOW ACCOUNTS; > ``` > > For Snowflake servers with version prior to 9.17.0, use the following commands: > > ```text > USE ROLE ORGADMIN; > SHOW ORGANIZATION ACCOUNTS; > ``` To configure connection settings, complete the following: 1. Enter the **Base URL** to connect to the Snowflake system. For example, `https://-.snowflakecomputing.com`. 2. Select the **Authentication Type** used to connect to the Snowflake system. 3. Enter the **Organization** configured in the Snowflake organization. 4. Enter the Snowflake **Account** configured for the Snowflake organization. 5. Enter the **Username** to log into the Snowflake organization account. 6. Enter the **Private Key** used to authenticate with the Snowflake system. For more information on generating private keys, refer to [Generating Keys](). > **Note** > > When you enter the private key you must enter the whole private key, including the BEGIN PRIVATE KEY and END PRIVATE KEY lines. For example: > > ```text > -----BEGIN ENCRYPTED PRIVATE KEY----- > *HASH VALUE* > -----END ENCRYPTED PRIVATE KEY----- > ``` 7. Enter the **Passphrase** to validate the private key. This was created when you generated the public and private keys. 8. Select **Save**. ### Configure Database Filter Settings You can enter the names of any databases to include or exclude from connector operations. > [!CAUTION] > > Configuring the connector to include some databases and simultaneously exclude others may cause aggregation processes to fail. > [!NOTE] > > If the database name contains any lowercase letters or special characters other than an underscore ( `_` ), enclose the name in double quotes ( `"` ). > > For example, you can enter the following: > > ```text > SNOWFLAKE, SALES_DB, "hr@DB", "admin-db" > ``` 1. Do either of the following: - In the **Include Databases** field, enter a comma-separated list of databases names to include in aggregation and provisioning operations. - In the **Exclude Databases** field, enter a comma-separated list of databases names to exclude from aggregation and provisioning operations. 2. Select **Save**. ## Aggregation Settings You can use the Aggregation Settings page to configure your aggregation timeout. For more information about aggregation, refer to [Loading Account Data](). > [!NOTE] > > **Screenshot** > > [![alt text]()]() To configure aggregation settings, complete the following: 1. Enter the **Aggregation Timeout** duration in seconds. This specifies the amount of time the connector waits for aggregation to complete. If aggregation is not complete by the end of the timeout, aggregation fails. The default value is 180 seconds. 2. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. # Data Access Security ## Identity Collectors An Identity Collector synchronizes identity data such as accounts and attributes for users, groups, and their relationships from your source into Data Access Security. You can use these Identity Collectors when you create Data Access Security applications to perform identity forensics and permission analysis. > [!IMPORTANT] > > You need a license to access Identity Collectors. Contact your SailPoint Customer Success Manager (CSM) to request access and for more information. ## Prerequisites Before you configure Identity Collectors, ensure the following requirements are met: - Your tenant has a Data Access Security license. - Data Access Security Identity Collectors is enabled for your tenant. - You completed Source Setup for the Snowflake source. > [!NOTE] > > **Screenshot** > > [![alt text]()]() ## Creating an Identity Collector To create an Identity Collector, perform the following steps: 1. Select **Create Identity Collector**. 2. Enter a unique **Name** for the Identity Collector. 3. Select **Save**. This links the Identity Collector to your source and sets Snowflake as a collector type. > [!NOTE] > > You can also manage Identity Collectors that you create here under **Data Access Security \> Admin \> Identity Collectors**. For more information on managing Identity Collectors in the Data Access Security, refer to [Create an Identity Collector](). ## Editing or Deleting an Identity Collector To edit an Identity Collector: 1. Select the Identity Collector you want to edit. 2. Select **Edit**. 3. Update the **Name**. 4. Select **Save**. To delete an Identity Collector: 1. Select the Identity Collector you want to delete. 2. Select **Delete**. 3. Confirm the deletion. # Integrating SailPoint with Snowflake The SailPoint Snowflake integration is capable of end-to-end user administration with the provisioning and password management capabilities of Snowflake, helping provide rich governance and control experience to your enterprise deployment. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Snowflake source. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The SailPoint Snowflake connector supports the following features. > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to [Working With Services](). #### Account Management - Manages Snowflake Users - Aggregate and Refresh Accounts - Create and Update Accounts - Enable, Disable, Unlock, and Change Password - Add or Remove Entitlements as Roles and Database Roles #### Entitlement Management - Manage Snowflake Entitlements as Roles and Database Roles - Refresh and Aggregate Entitlements For more information on features, refer to [Source Features](). ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). - To connect to Snowflake, you must have a public and private key or you must generate them. The keys are generated in the PEM format. For more information, refer to [Generating Keys](<#generating-keys>). > **Note** > > - SailPoint only supports the encrypted private key for connecting to Snowflake to ensure maximum security. > - By default, Windows systems do not support OpenSSL. You may need to download and install the OpenSSL libraries to generate your keys. Apple systems support OpenSSL by default. Go to [OpenSSL]() to download OpenSSL for Windows. ### Generating Keys To connect to Snowflake, you must have a public and private key or you must generate them. The keys are generated in the PEM format. > [!NOTE] > > - SailPoint only supports the encrypted private key for connecting to Snowflake to ensure maximum security. > - By default, Windows systems do not support OpenSSL. You may need to download and install the OpenSSL libraries to generate your keys. Apple systems support OpenSSL by default. Go to [OpenSSL]() to download OpenSSL for Windows. > - The generated private key is required as an input on the **Connection Settings** page. To generate the private and public keys, complete the following: 1. On your system, open a command prompt, terminal, or emulator and use the following command to generate an encrypted version of the private key: `openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8` The command to generate an encrypted key prompts you to enter a passphrase to regulate access to the key. SailPoint recommends storing the passphrase in a secure location. 2. Use the following command to generate an encrypted version of the public key: `openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub` 3. Copy the public and private key files to a local directory for storage. Record the path to the files. > **Note** > > The private key is stored using the PKCS\#8 (Public Key Cryptography Standards) format and is encrypted using the passphrase you specified in the first step. However, the file should still be protected from unauthorized access using the file permission mechanism provided by your operating system. It is your responsibility to secure the file when it is not being used. ## Required Permissions Configure the permissions required to grant necessary access rights to resources or data within the system to perform connector operations. ### Administrative Account Permissions Complete the following to set up a Snowflake administrative account with the minimum required permissions for the listed operation: 1. Log in to Snowflake with the `ACCOUNTADMIN` role and execute the following command: ```text CREATE USER "UserName" type = SERVICE; ``` > **Note** > > SailPoint recommends setting the user to the `Service` type. 2. Generate the public key. The public key is in the PEM format. For more information on generating the public key, refer to [Generating Keys](<#generating-keys>). The following is an example of the public key in PEM format: ```text -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy+Fw2qv4Roud3l6tjPH4 zxybHjmZ5rhtCz9jppCV8UTWvEXxa88IGRIHbJ/PwKW/mR8LXdfI7l/9vCMXX4mk ... -----END PUBLIC KEY----- ``` 3. In the following command, replace `PublicKey` with the key you generated (do not include the `BEGIN PUBLIC KEY` and `END PUBLIC KEY` lines): ```text ALTER USER "UserName" SET RSA_PUBLIC_KEY='PublicKey'; ``` For example: ```text ALTER USER MYUSER SET RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1hhZwJvU4+MiD92bLLmf zvdieU6TvuaSrjKJGtEndSWRR3p2pMFIzDWbbX1PHPqtt43C+meMtKtwMVl8JWEk IawC7ZnfjHROufWVhpb+8DwhHuH/r7GWXCNCyjJTH/Z+htdIYFM/pbSKW1Qdt5X0 Bf5TGINAe9XxL2Zp5kqo8pYMiPGudgUdYQlMGZ6y1AH0Rcb76KUkoHNrJQA/xRI8 LSDMNJQSJo6rPGARD1Rn9ns0Z3M1qnoH6LOOX0GX3T4GU+ERwPaMVcMjkweSA3a1 sqLhq+9hpC8piW+LaEv2clj1Sp73m70qh/0l8Cb2O4sq7Iov8G8Iahe0LGLVQX3+ uQIDAQAB'; ``` 4. Use the following command to grant the `ACCOUNTADMIN` role to a user: ```text GRANT ROLE ACCOUNTADMIN TO USER "UserName"; ``` 5. Use the following command to verify the user's public key fingerprint: ```text DESCRIBE USER "UserName"; ``` ### SYSADMIN Role Snowflake recommends creating a hierarchy of custom roles, with the top-most custom role assigned to the system role `SYSADMIN`. For more information, refer to the [Snowflake documentation](). > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. 1. Use the following command to create a role: ```text CREATE ROLE "Rolename"; ``` 2. Use the following command to assign the SYSADMIN role to the new role: ```text GRANT ROLE "Rolename" TO ROLE SYSADMIN; ``` ### Role Permissions Use the following command to grant a role to a user: ```text GRANT ROLE "Rolename" TO USER "UserName"; ``` Use the following command to set a user's default role: ```text ALTER USER "UserName" SET DEFAULT_ROLE = "Rolename"; ``` ### Test Connection Permissions By default, when you create a user, it is assigned a bare minimum role (PUBLIC). Only a bare minimum role is required for to test your connection. ### Account Aggregation Permissions This command can only be executed by users with a role that has the `MANAGE GRANTS` global privilege. ```text GRANT MANAGE GRANTS ON ACCOUNT TO ROLE "Rolename"; ``` Create a new warehouse if one doesn't already exist. ```text CREATE WAREHOUSE "WAREHOUSE_NAME" ; ``` Use the following command to set `default_warehouse` to a user. ```text ALTER USER "UserName" SET DEFAULT_WAREHOUSE = "WAREHOUSE_NAME"; ``` Use the following command to provide warehouse usage on the role. ```text GRANT USAGE ON WAREHOUSE "WAREHOUSE_NAME" TO ROLE "RoleName"; ``` ### Group Aggregation Permissions By default, when you create a user, it is assigned a bare minimum role (PUBLIC). Only a bare minimum role is required to perform a group aggregation. ### Create Account Permissions The CREATE command can only be executed by users with a role that has the CREATE USER global privilege. ```text GRANT CREATE USER ON ACCOUNT TO ROLE "Rolename"; ``` ### Modify, Enable, Disable, Unlock, or Change Password Permissions Note the following with the OWNERSHIP privilege: - The OWNERSHIP privilege grants the ability to delete, alter, rename, and grant or revoke access to an object. - OWNERSHIP is a special privilege on an object that is automatically granted to the role that created the object, but can also be transferred to a different role by the owning role (or any role with the MANAGE GRANTS privilege) using the `GRANT OWNERSHIP` command. - The OWNERSHIP privilege grants full control over an object. Only a single role can hold this privilege on a specific object at a time. For more information on the GRANT OWNERSHIP command, refer to the [Snowflake documentation](). Only the role with the OWNERSHIP privilege on the user, or a higher role, can execute this command to modify most user properties. To grant ownership permissions, use the following command: ```text GRANT OWNERSHIP ON USER "UserName" TO ROLE "Rolename"; ``` Where `UserName` refers to the name of the user that you are modifying. > [!NOTE] > > To modify, enable, disable, unlock, or change the password of a user, a minimum permission user assigned role should have ownership permission on the user who you are modifying. # Machine Account Attributes ## Machine Account Provisioning Attributes The following list contains the fields used in machine account creation. > [!NOTE] > > Parameters marked with an asterisk (\*) are mandatory. | Field (Name) | Type | Required | Initial Value / Mapping | Allowed Values / Notes | | --- | --- | --- | --- | --- | | name\* | string | Yes | Static: Enter unique username. | Set this to a unique Snowflake username for machine account creation. | | email\* | string | Yes | Disable (no default transform in template) | Provide this value at request time. | | display\_name\* | string | Yes | Disable (no default transform in template) | Provide this value at request time. | | login\_name | string | No | Disable | Use this when the login name differs from `name`. | | type\* | string | Yes | Static: SERVICE | machine-account indicator used by classification criteria. | | disabled | boolean | No | Disable | Account state flag. | | default\_warehouse | string | No | Disable | Default warehouse assignment. | | default\_role | string | No | Disable | Default role assignment. | | default\_secondary\_roles | string | No | Disable | Default secondary role behavior. | For additional details about machine account implementation, refer to the [Machine Identity Security Overview](). ### Classification The Classification attribute is used to identify and categorize the account as a Machine Account. Attribute name : type Value : SERVICE / LEGACY\_SERVICE / SNOWFLAKE\_SERVICE For additional details about machine account classification, refer to [Classifying Machine Accounts](). # Provisioning The Snowflake connector supports provisioning, allowing you to create and manage accounts and entitlements in Snowflake directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes The following generators create the required information for a new Snowflake account: | Account Attribute | Mapping Type | Description | | --- | --- | --- | | name\* | Identity Attribute | Identifier for the user; must be unique for your account. | | type | Disable | Specifies the type of user. This property is used to differentiate between human and machine users. | | password | Generator | User's password.
The default Generator is **Create Password**. | | first\_name | Identity Attribute | User's first name. | | last\_name | Identity Attribute | User's first, middle, and last name. | | login\_name | Disable | Name that the user enters to log into the system. Login names for users must be unique across your entire account. | | display\_name | Identity Attribute | Name displayed for the user in the Snowflake web interface. | | email | Identity Attribute | User's email address. | | must\_change\_password | Disable | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. | | disabled | Disable | Specifies whether the user is disabled, which prevents the following actions:
For new users, the user is locked out of Snowflake and cannot log in.
For existing users, setting the property aborts all their currently-running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. | | default\_warehouse | Disable | Specifies the virtual warehouse that is active by default for the user's session upon login. | | default\_role | Disable | Specifies the primary role that is active by default for the user's session upon login. | | default\_secondary\_roles | Disable | Specifies the set of secondary roles that are active for the user's session upon login. | > [!NOTE] > > Parameters marked with an asterisk (\*) are mandatory. ### Update Account Attributes | Account Attribute | Mapping Type | Description | | --- | --- | --- | | password | Generator | User's password.
The default Generator is **Create Password**. | | type | Disable | Specifies the type of user. This property is used to differentiate between human and machine users. | | first\_name | Identity Attribute | User's first name. | | last\_name | Identity Attribute | User's first, middle, and last name. | | login\_name | Disable | Name that the user enters to log into the system. Login names for users must be unique across your entire account. | | display\_name | Identity Attribute | Name displayed for the user in the Snowflake web interface. | | email | Identity Attribute | User's email address. | | must\_change\_password | Disable | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. | | disabled | Disable | Specifies whether the user is disabled, which prevents the following actions:
For new users, the user is locked out of Snowflake and cannot log in.
For existing users, setting the property aborts all their currently-running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. | | default\_warehouse | Disable | Specifies the virtual warehouse that is active by default for the user's session upon login. | | default\_role | Disable | Specifies the primary role that is active by default for the user's session upon login. | | default\_secondary\_roles | Disable | Specifies the set of secondary roles that are active for the user's session upon login. | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Snowflake connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | name | Account | | name | Group | > [!CAUTION] > > The `name` attribute is an Account ID / Entitlement ID, don't change the value of `name` of the user/role from Snowflake system after aggregation, this can lead to issues with your integration. ### Default Account Attributes The Snowflake connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | name | Name of the user. | | type | Specifies the type of user. This property is used to differentiate between human and machine users. | | login\_name | Name that the user enters to log into the system. Login names for users must be unique across your entire account. | | display\_name | Name displayed for the user in the Snowflake web interface. | | first\_name | First name of the user. | | last\_name | First, middle, and last name of the user. | | email | Email address of the user. | | days\_to\_expiry | Specifies the number of days after which the user status is set to Expired and the user is no longer allowed to log in. | | comment | Specifies a comment for the user. | | disabled | Specifies whether the user is disabled, which prevents the following actions:
For new users, the user is locked out of Snowflake and cannot log in.
For existing users, setting the property aborts all their currently running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. | | must\_change\_password | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. | | snowflake\_lock | The user's lock/unlocked status in Snowflake. | | default\_warehouse | Specifies the virtual warehouse that is active by default for the user's session upon login. | | default\_namespace | Specifies the namespace (database only or database and schema) that is active by default for the user's session upon login. | | default\_role | Specifies the primary role that is active by default for the user's session upon login. | | databaseRoles | List of database roles assigned to the user | | default\_secondary\_roles | Specifies the set of secondary roles that are active for the user's session upon login. | | owner | Owner role of the user's account. | | roles | All roles directly assigned to the user. | #### Configurable Account Attributes The following is a list of attributes that are not provided out-of-the-box. You can add them to your schema to view various Snowflake user information. | Attribute Name | Description | | --- | --- | | locked\_until\_time | Timestamp indicating the user locked end time. The user remains locked until this time. | | expires\_at\_time | Timestamp indicating time when user expires. | | last\_success\_login | Timestamp indicating time of user's last successful login on Snowflake. | | mins\_to\_unlock | Specifies the number of minutes until the temporary lock on the user login is cleared. | | created\_on | Timestamp indicating time when user was created. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Role Attributes The Snowflake connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles. The Role group schema contains the following attributes by default. | Attribute Name | Description | | --- | --- | | name | Role's unique identifier name | | is\_default | Indicates if the role is a default entitlement for any user | | is\_current | Indicates if the role is a current entitlement for any user | | is\_inherited | Indicates if the role is inherited by another entitlement | | owner | Owner of the role | | comment | Specifies a comment for the role | | roles | List of inherited roles | | databaseRoles | List of child database roles assigned to the role | | privileges | Direct privileges assigned to the role | #### Default Database Attributes The Database Role group schema contains the following attributes by default. | Attribute Name | Description | | --- | --- | | name | The Database Role's name | | is\_default | Indicates if the database role is a default database role | | is\_current | Indicates if the database role is a current role | | is\_inherited | Indicates if the database role is inherited by another database role | | owner | Owner of the database role | | comment | Comment for the database role | | databaseRoles | List of child database roles assigned to the role | | privileges | Direct privileges assigned to the database role | #### Default Configurable Attributes The following is a list of attributes that are not provided out of the box. You can add them to your schema to view various Snowflake user information. | Attribute Name | Description | | --- | --- | | created\_on | Timestamp indicating time when role was created. | ## Default Machine Identity Attributes Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts. For more information, refer to [Machine Identity Security Overview](). # Migrate VA-based Source to a SaaS Source Some sources that are connected to virtual appliance (VA) clusters can be migrated to SaaS connections. This ensures data (users and entitlements) remain intact and can maintains your source configurations like access profiles, roles, password settings, and correlation configurations when switching from a VA cluster to a SaaS connection. To migrate a source from a VA-based source to a SaaS source, you will provide configuration details on a draft version of the source before publishing the source. > [!NOTE] > > - You must have an Admin or Source Admin user level to migrate a source. A draft version of the source is created. As your migration process is in progress the live source will continue to work as it is. For more information on the Snowflake SaaS connector, refer to the [Snowflake SaaS Supported Features](). ## Important Considerations Before Migrating - You do not need to edit additional configurations (other than connection credentials) to migrate the source. - If your source migration is in progress, please do not make any configuration changes to your live source as those can be overwritten once you apply the migration your draft version. - Once you've gone ahead with your migration, it can't be rolled back. Your source is permanently migrated to a SaaS source. - Any preview operations or configuration changes on the draft source will not impact the live source until you apply the migration. ## Migrating Sources To migrate your source, complete the following: 1. Go to **Admin \> Connections \> Sources**. 2. Select or edit the VA-based source you want to migrate. 3. Open the source configuration, and select **Migrate to SaaS**. 4. When prompted, select **Continue**. A draft version of the source is created. The live source will continue to work. 5. Select **Connection Settings**. 6. Re-enter encrypted configuration details. For example, you might need to re-enter the Client Secret, Password, Refresh Token, Personal Access Token (PAT), or Certificates to migrate from the VA cluster to the SaaS connection. > **Important** > > Avoid editing the other configuration options in the draft source. 7. Select **Review and Test**. 8. Select **Test Connection**. 9. (Optional) Select **Accounts**. If you successfully tested your connection in **Review and Test**, you can select **Preview** to display a subset of accounts from the application that will be mapped to SailPoint identities. This can help ensure you are accurately connecting identity data from the application with SailPoint identities. 10. (Optional) Select **Entitlements**. If you successfully tested your connection in **Review and Test** and your source type supports entitlement type configuration, you can select **Preview** to view a preview of entitlements using the current configuration settings. 11. When you've finished reviewing your changes and successfully tested your connection, select **Apply Migration**. Your changes will be applied to the live source and the draft source will be deleted. ## Viewing Source Migration Status You can view the status and creation date of draft sources. 1. Go to **Admin \> Connections \> Sources \> Source Migration Status**. 2. Select **Source Migration Status**. 3. To view or edit the draft source, select **Actions** ![]() **\> Preview** on the draft source. 4. To delete the draft source, select **Actions** ![]() **\> Delete** on the draft source. # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Provisioning Operations Fail for the PUBLIC Role **Issue**: During Add or Remove entitlement processes, if a role is identified as `PUBLIC`, the connector throws an exception and marks the item as failed. **Resolution**: No actions are necessary. Operations involving the `PUBLIC` role have no impact on the Snowflake-managed system. The `PUBLIC` role is a mandatory default role granted to all users and cannot be revoked. ## Aggregation Fails With Exception Error Aggregation fails with one of the following exception errors: - org.apache.http.NoHttpResponseException: failed to respond - connector.sdk.webservices.exception.WebServicesSdkException: java.net.SocketException: Socket closed **Resolution**: Add the following attribute using the Rest API for updating a source, and then run aggregation. ```text Key= conSnowflakeApiRetrySleepTimeSeconds Value= 60000 in ms, default: 30000 ms Key=conSnowflakeApiRetryMaxAttempts Value=3, default: 3 Key=retryableErrors Value=[error messages] ``` ## Account or Entitlement Aggregation Fails Due to a Timeout Error **Resolution**: Go to the **Aggregation Settings** page and increase the value in the **Aggregation Timeout** field. The default value is 180 seconds. ## Aggregations With Filtered Databases Fail If you configured the connector to include some databases and exclude others, account aggregations processes are likely to fail. The connector can either include some databases or exclude databases. **Resolution**: Configure the scope of the databases that the connector aggregates using either the **Include Databases** field or the **Exclude Databases** field, but not both. ## SQL Compilation Error When You Configure the DEFAULT\_SECONDARY\_ROLES Attribute When you try to configure the `DEFAULT_SECONDARY_ROLES` attribute, you get the following error: ```text SQL compilation error: invalid value [[()]] for parameter 'DEFAULT_SECONDARY_ROLES' ``` **Resolution**: Snowflake changed the default behavior of the `DEFAULT_SECONDARY_ROLES` attribute. Following this update, a user's `DEFAULT_SECONDARY_ROLES` attribute is set to `ALL` by default. For more information refer to the [Snowflake knowledge base](). > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. Based on your required configuration, configure one of the following: - To set the `DEFAULT_SECONDARY_ROLES` attribute to `('ALL')`, pass the value as `null`, `NULL`, `('all')`, or `('ALL')`. For example: ```text ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = null; ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = NULL; ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ('all'); ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = ('ALL'); ``` - To set the `DEFAULT_SECONDARY_ROLES` to an empty value, pass the value as `()`. For example: ```text ALTER USER ANIKET SET DEFAULT_SECONDARY_ROLES = (); ``` ## Entitlement Aggregation Fails With SQL Execution Cancelled Error Entitlement Aggregation fails with an SQL Execution Cancelled message or it is taking too long to complete. **Resolution**: If your aggregation requirements will allow for it, you can remove roles and privileges from the Role schema to skip the `SHOW GRANTS TO ROLE` query. This action can expedite the entitlement aggregation process and avoid a timeout error. > [!IMPORTANT] > > Making this change includes roles fetched during entitlement aggregation but not the privileges assigned to them. You can also review timeout options in [Timeout Errors and Settings](). # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```