Provisioning
The Snowflake connector supports provisioning, allowing you to create and manage accounts and entitlements in Snowflake directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Default Create Account Attributes
The following generators create the required information for a new Snowflake account:
| Account Attribute | Mapping Type | Description |
|---|---|---|
| name* | Identity Attribute | Identifier for the user; must be unique for your account. |
| type | Disable | Specifies the type of user. This property is used to differentiate between human and machine users. |
| password | Generator | User's password. The default Generator is Create Password. |
| first_name | Identity Attribute | User's first name. |
| last_name | Identity Attribute | User's first, middle, and last name. |
| login_name | Disable | Name that the user enters to log into the system. Login names for users must be unique across your entire account. |
| display_name | Identity Attribute | Name displayed for the user in the Snowflake web interface. |
| Identity Attribute | User's email address. | |
| must_change_password | Disable | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. |
| disabled | Disable | Specifies whether the user is disabled, which prevents the following actions: For new users, the user is locked out of Snowflake and cannot log in. For existing users, setting the property aborts all their currently-running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. |
| default_warehouse | Disable | Specifies the virtual warehouse that is active by default for the user's session upon login. |
| default_role | Disable | Specifies the primary role that is active by default for the user's session upon login. |
| default_secondary_roles | Disable | Specifies the set of secondary roles that are active for the user's session upon login. |
Note
Parameters marked with an asterisk (*) are mandatory.
Update Account Attributes
| Account Attribute | Mapping Type | Description |
|---|---|---|
| password | Generator | User's password. The default Generator is Create Password. |
| type | Disable | Specifies the type of user. This property is used to differentiate between human and machine users. |
| first_name | Identity Attribute | User's first name. |
| last_name | Identity Attribute | User's first, middle, and last name. |
| login_name | Disable | Name that the user enters to log into the system. Login names for users must be unique across your entire account. |
| display_name | Identity Attribute | Name displayed for the user in the Snowflake web interface. |
| Identity Attribute | User's email address. | |
| must_change_password | Disable | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. |
| disabled | Disable | Specifies whether the user is disabled, which prevents the following actions: For new users, the user is locked out of Snowflake and cannot log in. For existing users, setting the property aborts all their currently-running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. |
| default_warehouse | Disable | Specifies the virtual warehouse that is active by default for the user's session upon login. |
| default_role | Disable | Specifies the primary role that is active by default for the user's session upon login. |
| default_secondary_roles | Disable | Specifies the set of secondary roles that are active for the user's session upon login. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.