CREATE SECURITY INTEGRATION (OIDC)¶

Creates a new OIDC security integration in the account or replaces an existing integration. An OIDC security integration provides single sign-on (SSO) workflows by creating an interface between Snowflake and an OpenID Connect identity provider (IdP).

For information about creating other types of security integrations (for example, SAML2), see CREATE SECURITY INTEGRATION.

For conceptual information and configuration walkthroughs, see Configuring OpenID Connect (OIDC) federated authentication.

See also:: ALTER SECURITY INTEGRATION (OIDC) , DROP INTEGRATION , SHOW INTEGRATIONS , DESCRIBE INTEGRATION

Syntax¶

The required parameters depend on the value of OIDC_PROVIDER:

When OIDC_PROVIDER='CUSTOM', you must specify OIDC_ISSUER, OIDC_CLIENT_ID, and OIDC_CLIENT_SECRET.
When OIDC_PROVIDER='GOOGLE', do not specify OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_SCOPES, the endpoint parameters, or the user-mapping parameters (OIDC_TOKEN_USER_MAPPING_CLAIM, OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE). Snowflake manages these for the managed provider and fixes user mapping to the email claim → EMAIL_ADDRESS.

Custom provider¶

CREATE [ OR REPLACE ] SECURITY INTEGRATION [ IF NOT EXISTS ]
    <name>
    TYPE = OIDC
    [ ENABLED = { TRUE | FALSE } ]
    OIDC_PROVIDER = 'CUSTOM'
    OIDC_ISSUER = '<string_literal>'
    OIDC_CLIENT_ID = '<string_literal>'
    OIDC_CLIENT_SECRET = '<string_literal>'
    OIDC_TOKEN_USER_MAPPING_CLAIM = '<string_literal>'
    OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = { 'LOGIN_NAME' | 'EMAIL_ADDRESS' }
    [ OIDC_LOGIN_PAGE_LABEL = '<string_literal>' ]
    [ OIDC_ENABLE_SSO_LOGIN_PAGE = { TRUE | FALSE } ]
    [ OIDC_SCOPES = ( '<string_literal>' [ , '<string_literal>' , ... ] ) ]
    [ OIDC_AUTHORIZATION_ENDPOINT = '<string_literal>' ]
    [ OIDC_TOKEN_ENDPOINT = '<string_literal>' ]
    [ OIDC_JWKS_URI = '<string_literal>' ]
    [ OIDC_USERINFO_ENDPOINT = '<string_literal>' ]
    [ ALLOWED_USER_DOMAINS = ( '<string_literal>' [ , '<string_literal>' , ... ] ) ]
    [ ALLOWED_EMAIL_PATTERNS = ( '<string_literal>' [ , '<string_literal>' , ... ] ) ]
    [ COMMENT = '<string_literal>' ]

Managed provider (Google)¶

CREATE [ OR REPLACE ] SECURITY INTEGRATION [ IF NOT EXISTS ]
    <name>
    TYPE = OIDC
    [ ENABLED = { TRUE | FALSE } ]
    OIDC_PROVIDER = 'GOOGLE'
    [ OIDC_LOGIN_PAGE_LABEL = '<string_literal>' ]
    [ OIDC_ENABLE_SSO_LOGIN_PAGE = { TRUE | FALSE } ]
    [ ALLOWED_USER_DOMAINS = ( '<string_literal>' [ , '<string_literal>' , ... ] ) ]
    [ ALLOWED_EMAIL_PATTERNS = ( '<string_literal>' [ , '<string_literal>' , ... ] ) ]
    [ COMMENT = '<string_literal>' ]

Required parameters¶

name

String that specifies the identifier (that is, name) for the integration; must be unique in your account.

In addition, the identifier must start with an alphabetic character and can’t contain spaces or special characters unless the entire identifier string is enclosed in double quotes (for example, "My object"). Identifiers enclosed in double quotes are also case-sensitive.

For more details, see Identifier requirements.

TYPE = OIDC

Specify the type of integration:

OIDC: Creates a security interface between Snowflake and an OpenID Connect identity provider.

OIDC_PROVIDER = { 'CUSTOM' | 'GOOGLE' }

The identity provider type. Valid values:

CUSTOM: Any OpenID Connect-compliant identity provider. You provide client credentials and either an issuer URL (for endpoint discovery) or explicit endpoints.
GOOGLE: Google as a managed provider. Snowflake manages the OAuth client configuration.

Default: CUSTOM.

Immutable after creation. To change the provider, drop and recreate the integration.

Case-insensitive.

Required parameters (custom providers only)¶

The following parameters are required when OIDC_PROVIDER='CUSTOM'. They are rejected when OIDC_PROVIDER='GOOGLE'. For the managed provider, Snowflake fixes user mapping to the email claim → EMAIL_ADDRESS, so the mapping parameters can’t be set.

OIDC_ISSUER = 'string_literal'

The IdP issuer URL. Must be HTTPS. Used for token validation and endpoint discovery.

Immutable after creation.

OIDC_CLIENT_ID = 'string_literal'

The OAuth 2.0 client ID registered with the IdP.

Immutable after creation.

OIDC_CLIENT_SECRET = 'string_literal'

The OAuth 2.0 client secret registered with the IdP. Encrypted at rest. Not returned by DESCRIBE INTEGRATION. Can be rotated using ALTER SECURITY INTEGRATION (OIDC).

OIDC_TOKEN_USER_MAPPING_CLAIM = 'string_literal'

The ID token claim used to identify the Snowflake user. Specify a single claim name (for example, 'email'), or an ordered list of claim names (for example, ('email', 'sub')). Custom claim names are also accepted. Only string-valued claims are supported; a non-string claim (number, boolean, or object) is stringified and typically won’t match any Snowflake user attribute.

When you specify a list, Snowflake extracts all non-empty values from the listed claims in order, then attempts user lookup with each value against OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE, using the first successful match. If a claim is absent from the ID token, Snowflake skips it and tries the next.

OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = { 'LOGIN_NAME' | 'EMAIL_ADDRESS' }

The Snowflake user attribute to match against the token claim value. For EMAIL_ADDRESS, additional rules apply; see Verified email requirement.

Optional parameters¶

ENABLED = { TRUE | FALSE }

Whether the integration is active. Set to TRUE to expose the integration on the login page (subject to OIDC_ENABLE_SSO_LOGIN_PAGE and any allow-lists).

Default: TRUE.

OIDC_SCOPES = ( 'string_literal' [ , 'string_literal' , ... ] )

The OAuth scopes to request. Must include openid.

Default: ('openid', 'profile', 'email').

Custom providers only. Managed providers reject this option.

OIDC_AUTHORIZATION_ENDPOINT = 'string_literal'

The IdP authorization endpoint URL. If not provided, discovered from the issuer metadata. Must be HTTPS.

Immutable after creation. Custom providers only.

OIDC_TOKEN_ENDPOINT = 'string_literal'

The IdP token endpoint URL. If not provided, discovered from the issuer metadata. Must be HTTPS.

Immutable after creation. Custom providers only.

OIDC_JWKS_URI = 'string_literal'

The IdP JWKS (JSON Web Key Set) endpoint URL for ID token signature verification. If not provided, discovered from the issuer metadata. Must be HTTPS.

Immutable after creation. Custom providers only.

OIDC_USERINFO_ENDPOINT = 'string_literal'

The IdP UserInfo endpoint URL. Reserved for forward compatibility. Snowflake does not call this endpoint during authentication in the current release. User resolution uses claims in the ID token only (OIDC_TOKEN_USER_MAPPING_CLAIM); there is no UserInfo fallback for missing claims. If not provided, Snowflake may populate this value from issuer discovery metadata. The URL must use HTTPS. Returned by DESCRIBE INTEGRATION only when set or discovered. Custom providers only.

OIDC_LOGIN_PAGE_LABEL = 'string_literal'

The label displayed on the Snowflake login page for this IdP (for example, Sign in with Okta). If not provided, the integration name is used as the label.

OIDC_ENABLE_SSO_LOGIN_PAGE = { TRUE | FALSE }

Whether to display this integration on the Snowflake login page. When FALSE, the integration exists and is enabled but is not rendered as a Sign in with X button.

Default: TRUE.

ALLOWED_USER_DOMAINS = ( 'string_literal' [ , 'string_literal' , ... ] )

Restricts authentication to users whose email domain exactly matches one of the specified domains (for example, ('mycompany.com', 'subsidiary.com')). Matching is case-insensitive and exact: mycompany.com matches user@mycompany.com but not user@evil-mycompany.com or user@mycompany.com.attacker.com. The filter applies both at the login-page selection step and at user resolution after the IdP returns.

This parameter can be used to associate a user with an IdP for configurations that use multiple IdPs. For details, see Using multiple identity providers for federated authentication.

ALLOWED_EMAIL_PATTERNS = ( 'string_literal' [ , 'string_literal' , ... ] )

Restricts authentication to users whose email matches one of the specified regex patterns. Patterns use Java Pattern.find() semantics. Anchor with ^...$ for full-string matching.

Requires the ENABLE_IDENTIFIER_FIRST_LOGIN account parameter to be enabled.

This parameter can be used to associate a user with an IdP for configurations that use multiple IdPs. For details, see Using multiple identity providers for federated authentication.

COMMENT = 'string_literal'

Specifies a comment for the integration.

Default: No value

Read-only properties¶

The following property is returned by DESCRIBE INTEGRATION but can’t be set in a CREATE or ALTER command:

OIDC_REDIRECT_URIS: The callback URL(s) that Snowflake generates for this account. This property is always a list. Provide the appropriate URL to your IdP when registering Snowflake as a custom OAuth client. For custom providers the format is https://<account_url>/oauth2/oidc/callback. An account may expose more than one callback host (for example, account-locator, organization, and Private Link URLs), so register each URI your users might connect through. For managed providers, DESC INTEGRATION returns the Snowflake-managed callback host (typically https://identity.snowflake.com/oauth2/callback); you do not register it with the IdP.

Access control requirements¶

A role used to execute this operation must have the following privileges at a minimum:

Privilege	Object	Notes
CREATE INTEGRATION	Account	Only the ACCOUNTADMIN role has this privilege by default. The privilege can be granted to additional roles as needed.

For instructions on creating a custom role with a specified set of privileges, see Creating custom roles.

For general information about roles and privilege grants for performing SQL actions on securable objects, see Overview of Access Control.

Usage notes¶

Unless identifier-first login is enabled, only one SSO integration (SAML2 or OIDC) can be ENABLED=TRUE at a time. For details, see Configuring an OIDC security integration.
For managed providers (OIDC_PROVIDER='GOOGLE'), you can’t set OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_SCOPES, the endpoint parameters (OIDC_AUTHORIZATION_ENDPOINT, OIDC_TOKEN_ENDPOINT, OIDC_JWKS_URI, OIDC_USERINFO_ENDPOINT), or the user-mapping parameters (OIDC_TOKEN_USER_MAPPING_CLAIM, OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE). Snowflake manages these values and fixes user mapping to the email claim → EMAIL_ADDRESS. Setting any of these options causes the CREATE to fail.
If you do not provide the endpoint parameters (OIDC_AUTHORIZATION_ENDPOINT, OIDC_TOKEN_ENDPOINT, OIDC_JWKS_URI), Snowflake automatically discovers them from the issuer’s .well-known/openid-configuration metadata document. See OpenID Connect discovery. If you provide some but not all of the three required endpoints, the CREATE is rejected.
If you create an integration with placeholder credentials before retrieving the real client ID from your IdP, and the real client ID does not match the placeholder, you must drop the integration and recreate it with the real value.
The following properties are immutable after creation. To change any of them, drop the integration and recreate it: OIDC_PROVIDER, OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_AUTHORIZATION_ENDPOINT, OIDC_TOKEN_ENDPOINT, OIDC_JWKS_URI. The read-only OIDC_REDIRECT_URIS property is generated by Snowflake and can’t be set.

The OR REPLACE and IF NOT EXISTS clauses are mutually exclusive. They can’t both be used in the same statement.
CREATE OR REPLACE <object> statements are atomic. That is, when an object is replaced, the old object is deleted and the new object is created in a single transaction.

Example¶

Custom provider¶

CREATE SECURITY INTEGRATION my_okta_oidc
  TYPE = OIDC
  ENABLED = TRUE
  OIDC_PROVIDER = 'CUSTOM'
  OIDC_ISSUER = 'https://mycompany.okta.com/oauth2/default'
  OIDC_CLIENT_ID = '0oab1cdef2ghij3klm4n'
  OIDC_CLIENT_SECRET = 'AbCdEfGhIjKlMnOpQrStUvWxYz0123456789'
  OIDC_TOKEN_USER_MAPPING_CLAIM = 'email'
  OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'EMAIL_ADDRESS'
  OIDC_LOGIN_PAGE_LABEL = 'Sign in with Okta';

Custom provider with explicit endpoints¶

CREATE SECURITY INTEGRATION my_okta_oidc
  TYPE = OIDC
  ENABLED = TRUE
  OIDC_PROVIDER = 'CUSTOM'
  OIDC_ISSUER = 'https://okta.mycompany.com/oauth2/default'
  OIDC_CLIENT_ID = '0oab1cdef2ghij3klm4n'
  OIDC_CLIENT_SECRET = 'AbCdEfGhIjKlMnOpQrStUvWxYz0123456789'
  OIDC_AUTHORIZATION_ENDPOINT = 'https://mycompany.okta.com/oauth2/default/v1/authorize'
  OIDC_TOKEN_ENDPOINT = 'https://mycompany.okta.com/oauth2/default/v1/token'
  OIDC_JWKS_URI = 'https://mycompany.okta.com/oauth2/default/v1/keys'
  OIDC_TOKEN_USER_MAPPING_CLAIM = 'preferred_username'
  OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'LOGIN_NAME'
  OIDC_SCOPES = ('openid', 'profile', 'email')
  OIDC_LOGIN_PAGE_LABEL = 'Sign in with okta';

Managed provider (Google)¶

CREATE SECURITY INTEGRATION my_google_oidc
  TYPE = OIDC
  ENABLED = TRUE
  OIDC_PROVIDER = 'GOOGLE';

View the integration settings using DESCRIBE INTEGRATION:

DESC SECURITY INTEGRATION my_okta_oidc;

The command returns one row per integration property with the columns property, property_type, property_value, and property_default. OIDC_CLIENT_SECRET is never returned.

Output behavior:

OIDC_REDIRECT_URIS is always returned. For custom providers, the value lists one or more callback URLs of the form https://<account_identifier>.snowflakecomputing.cn/oauth2/oidc/callback.
OIDC_PROVIDER is always returned. If you omit it in CREATE, the value is CUSTOM.
COMMENT is always returned, even when unset (empty property_value).
OIDC_USERINFO_ENDPOINT appears only when you set it explicitly or when issuer discovery populates it. It is omitted from output for minimal integrations that do not use it.
ALLOWED_USER_DOMAINS and ALLOWED_EMAIL_PATTERNS appear only when configured.
For OIDC_SCOPES, property_default shows the framework default ([openid, profile, email]) and property_value shows the configured value.
For boolean properties with defaults (for example, ENABLED, OIDC_ENABLE_SSO_LOGIN_PAGE), property_default reflects the CREATE default (true).

Custom provider (`OIDC_PROVIDER='CUSTOM'`)¶

The following example shows output for a fully configured custom integration (representative values):

property	property_type	property_value	property_default
ENABLED	Boolean	true	true
OIDC_ISSUER	String	https://okta.mycompany.com/oauth2/default
OIDC_CLIENT_ID	String	0oab1cdef2ghij3klm4n
OIDC_JWKS_URI	String	https://mycompany.okta.com/oauth2/default/v1/keys
OIDC_AUTHORIZATION_ENDPOINT	String	https://mycompany.okta.com/oauth2/default/v1/authorize
OIDC_TOKEN_ENDPOINT	String	https://mycompany.okta.com/oauth2/default/v1/token
OIDC_USERINFO_ENDPOINT	String	https://mycompany.okta.com/oauth2/default/v1/userinfo
OIDC_SCOPES	List	[openid, profile, email, groups]	[openid, profile, email]
OIDC_REDIRECT_URIS	List	[https://mycompany.snowflakecomputing.cn/oauth2/oidc/callback]
OIDC_ENABLE_SSO_LOGIN_PAGE	Boolean	true	true
OIDC_LOGIN_PAGE_LABEL	String	Sign in with Okta
OIDC_PROVIDER	String	CUSTOM
OIDC_TOKEN_USER_MAPPING_CLAIM	List	[email, sub]
OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE	String	EMAIL_ADDRESS
COMMENT	String	Test custom OIDC integration

OIDC_TOKEN_USER_MAPPING_CLAIM is returned as a list when multiple claims are configured (for example, [email, sub]).

Managed provider (`OIDC_PROVIDER='GOOGLE'`)¶

Managed integrations return a smaller property set. Snowflake-managed OAuth settings are not exposed as separate properties:

+--------------------------------+---------------+------------------------------------------+------------------+
| property                       | property_type | property_value                             | property_default |
|--------------------------------+---------------+------------------------------------------+------------------|
| ENABLED                        | Boolean       | true                                     | true             |
| OIDC_REDIRECT_URIS             | List          | [https://identity.snowflake.com/oauth2/callback] |          |
| OIDC_ENABLE_SSO_LOGIN_PAGE     | Boolean       | true                                     | true             |
| OIDC_PROVIDER                  | String        | GOOGLE                                   |                  |
| OIDC_TOKEN_USER_MAPPING_CLAIM  | String        | email                                    |                  |
| OIDC_SNOWFLAKE_USER_MAPPING_ATTRIBUTE | String | EMAIL_ADDRESS                            |                  |
| COMMENT                        | String        |                                          |                  |
+--------------------------------+---------------+------------------------------------------+------------------+

CREATE SECURITY INTEGRATION (OIDC)¶

Syntax¶

Custom provider¶

Managed provider (Google)¶

Required parameters¶

Required parameters (custom providers only)¶

Optional parameters¶

Read-only properties¶

Access control requirements¶

Usage notes¶

Example¶

Custom provider¶

Custom provider with explicit endpoints¶

Managed provider (Google)¶

Custom provider (OIDC_PROVIDER='CUSTOM')¶

Managed provider (OIDC_PROVIDER='GOOGLE')¶

Custom provider (`OIDC_PROVIDER='CUSTOM'`)¶

Managed provider (`OIDC_PROVIDER='GOOGLE'`)¶