Oauth authentication (for Snowpark Container Services)

[marksabincarnivaluk]

Hi,

I am running SnowDDL in Snowpark Container Services which requires oauth authentication. I've modified base.py accordingly and it works for my use-case. I would like to submit the code for review and merge.

New arguments:
OAUTH_TOKEN -t (env var: SNOWFLAKE_OAUTH_TOKEN).
HOST -o (env var: SNOWFLAKE_HOST) (would have used -h but reserved for help).

New --authenticator option: oauth

Are there any further changes I should consider to make this a viable, general solution for oauth authentication?

[littleK0i]

I guess we may introduce a special value --authenticator oauth_snowpark. And automatically use logic described in this post for auth, including automated read of token from file: https://medium.com/snowflake/connecting-to-snowflake-from-snowpark-container-services-cfc3a133480e

        creds = {
            'host': os.getenv('SNOWFLAKE_HOST'),
            'port': os.getenv('SNOWFLAKE_PORT'),
            'protocol': "https",
            'account': os.getenv('SNOWFLAKE_ACCOUNT'),
            'authenticator': "oauth",
            'token': open('/snowflake/session/token', 'r').read(),
            'warehouse': os.getenv('SNOWFLAKE_WAREHOUSE'),
            'database': os.getenv('SNOWFLAKE_DATABASE'),
            'schema': os.getenv('SNOWFLAKE_SCHEMA'),
            'client_session_keep_alive': True
        }

[marksabincarnivaluk]

I currently export the token to an env var like this:
export SNOWFLAKE_OAUTH_TOKEN=$(< /snowflake/session/token)

So are you thinking no new arguments are required, just simply an oauth_snowpark authenticator option that reads from env vars and token file?

[littleK0i]

If it is some sort of typical use case, why not. Personally I see no value in Snowpark for maintenance scripts, so I have no strong opinion.

I guess "normal" oauth uses browser. In theory, it should be available via --authenticator externalbrowser.

[marksabincarnivaluk]

Yes makes sense, it's clean and simple. I'll modify my code and submit a pull request.