Get User Credentials from Snowflake

Gather the user information and authentication details in Snowflake to create a data share target.

Important You can’t create legacy Snowflake data share targets. Create a Snowflake V2 data share target instead, and link your existing and new data shares to it. Migrate existing data shares that are linked to a legacy Snowflake data share target to a Snowflake V2 data share target. See Migrate Data Shares with Legacy Snowflake Data Share Target. Don’t unlink an existing data share from its legacy target until you verify that the Snowflake V2 connection works. Downstream processes in Snowflake can refer to the database that was created using the legacy target.

1. In Snowflake, create a user for Data 360 admin or Data Aware Specialist.

   
   CREATE OR REPLACE USER  <Data 360 Admin or Data Aware Specialist> 
     PASSWORD = '<string>'
     LOGIN_NAME = <string>
     DISPLAY_NAME = <string>
     FIRST_NAME = <string>
     MIDDLE_NAME = <string>
     LAST_NAME = <string>
     EMAIL = <string>
     DEFAULT_ROLE = <Any Public Role With Low Privileges>;
   

   If you want to use an existing user, you can skip creating a user. Make sure that the default role isn’t ACCOUNTADMIN, SECURITYADMIN, or ORGADMIN. The user must have USAGE privileges (Read & Query) for the relevant warehouse.
2. In Snowflake, create a security integration.

   
   CREATE OR REPLACE SECURITY INTEGRATION [IF NOT EXISTS]
     <Data Cloud_Snowflake_Security_Integration>
     TYPE = OAUTH
     OAUTH_CLIENT = CUSTOM
     OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
     OAUTH_REDIRECT_URI = 'https://login.salesforce.com/services/cdpSnowflakeOAuthCallback'
     ENABLED = TRUE 
     OAUTH_ISSUE_REFRESH_TOKENS = TRUE; 
   

   For a Data Cloud sandbox org, the OAUTH_REDIRECT_URI is https://test.salesforce.com/services/cdpSnowflakeOAuthCallback

3. In Snowflake, run the DESCRIBE statement to get the OAUTH_AUTHORIZATION_ENDPOINT details.

   DESC SECURITY INTEGRATION <Data Cloud_Snowflake_Security_Integration>;

   When you create a data share target in Data 360, for Account URL, enter the value of OAUTH_AUTHORIZATION_ENDPOINT and convert any underscores to hyphens and ignore the subdirectory and subsequent parts.

   For example, if your OAuth Authorization Endpoint URL is https://nto_america_dev_instance.example.computing.com/oauth/authorize, enter https://nto-america-dev-instance.example.computing.com for the Account Url.

4. In Snowflake, get the client credentials.

   SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS( '<Data Cloud_Snowflake_Integration>');

   Use the Client ID and Client Secret to create a data share target. Share the credentials with your Data 360 admin.