---
schema_version: "1"
id: 965cdcfb93b942c20698c6011872f3e1516e6b7926b906ccb57e65afe8d4d8c3
title: External OAuth for Snowflake
collection: tableau
version: next
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/next/en-gb/server-linux/snowflake_oauth_idp.md
canonical_url: https://help.tableau.com/v0.0/server-linux/en-gb/snowflake_oauth_idp.htm
source_site: help.tableau.com
content_type: documentation
content_hash: f473bd547ef2fcc830022d38dec6455194e11be392d43b15c7f02d53cf8de035
description: Configure external OAuth to federate identity from an IdP to Snowflake.
---
[Skip to main content](#main-content)

# External OAuth for Snowflake

Starting in Tableau 2024.3, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to Snowflake.

Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview intended to guide your configuration without providing the necessary details you'll find in your identity provider documentation. It is assumed you are familiar with configuring OAuth and understand the technical details required in setting up authentication with an external identity provider.

## Configure IDP on Snowflake

For information on configuring your IDP, see [External OAuth overview](https://docs.snowflake.com/en/user-guide/oauth-ext-overview) in Snowflake's help system.

## Configure the IDP on Tableau

1. Create OAuth clients on the IDP for Tableau Desktop, and for Tableau Cloud or Tableau Server. The Desktop client enables [PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) and uses `http://localhost` redirects.
2. Create the Tableau OAuth configuration file. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [github](https://tableau.github.io/connector-plugin-sdk/docs/oauth), as well as examples [here](https://github.com/tableau/en-gb/connector-plugin-sdk/tree/master/samples/components/oauth). We welcome additional examples for other IDPs.
    
    - Be sure to prefix the Tableau OAuth configuration IDs with ‘custom\_’.
        
        **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but they will not work.
    - If your IDP supports a dynamic localhost port, disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the configuration file and on the IDP.
3. Install the new Tableau OAuth configuration file in the OAuthConfigs folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth via the site settings page. For more details, see [Custom OAuth Configs on Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site-Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients).

## Connect to Snowflake

When connecting, you must select OAuth and choose the OAuth configuration installed earlier.

![](/tableau/next/en-gb/server-linux/en-gb/Img/snowflake_connect_oauth.png)

## Okta

If using Okta, it’s better to use a ‘custom authorisation server’ rather than the ‘org authorisation server’. The custom authorisation servers are more flexible. There’s a custom authorisation server created by default, which is called “default”. The authorisation URL should look like this:

`https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize`

![okta dashboard](/tableau/next/en-gb/server-linux/en-gb/Img/athena_okta.png)