July 20, 2026: OIDC federated authentication (Public Preview)¶

OpenID Connect (OIDC) security integrations for federated single sign-on (SSO) are available in Public Preview. Multiple OIDC integrations, or OIDC alongside an existing SAML2 integration, require identifier-first login. Without identifier-first login, only one SSO integration (SAML2 or OIDC) can be ENABLED=TRUE at a time.

Use a custom OIDC-compliant identity provider (IdP) or Google as a managed provider. Create an OIDC security integration with CREATE SECURITY INTEGRATION. For Google, Snowflake manages the OAuth client configuration:

CREATE SECURITY INTEGRATION my_google_oidc
  TYPE = OIDC
  ENABLED = TRUE
  OIDC_PROVIDER = 'GOOGLE'
  OIDC_LOGIN_PAGE_LABEL = 'Sign in with Google';

You can restrict login methods with authentication policies by setting AUTHENTICATION_METHODS to include OIDC. To require MFA after external authentication (including OIDC SSO), set MFA_POLICY=(ENFORCE_MFA_ON_EXTERNAL_AUTHENTICATION='ALL').

For more information, see OIDC federated authentication and SSO, CREATE SECURITY INTEGRATION (OIDC), and ALTER SECURITY INTEGRATION (OIDC).