Snowflake Key-Pair Authentication

Note: Snowflake will deprecate single-factor password authentication by Nov 2025. For more info, read here.

Key-pair authentication offers enhanced security by using RSA public/private key pairs instead of traditional passwords. This method is more secure and aligns with modern authentication best practices.

Prerequisites

Before starting the migration process, ensure you have:

• Administrative access to your Snowflake account

• Requisite access to make changes to your Clari integrations

• Terminal or command-line access for generating RSA keys

• OpenSSL is installed on your system

Choose Your Migration Path

This guide covers two distinct scenarios. Please follow the scenario that applies to your situation:

• Scenario A: Migrating existing connectors from username/password to key-pair authentication

• Scenario B: Creating a brand new Snowflake connector with key-pair authentication

Both scenarios require the same RSA key generation process, which is covered first.

RSA Key Generation

Before proceeding with either scenario, you'll need to generate RSA key pairs and configure your Snowflake user.

Step 1: Generate Private Key

Open your terminal and run the following command to generate a 2048-bit RSA private key:

openssl genrsa -out privkey_rsa2048.pem 2048

This creates a private key file named privkey_rsa2048.pem in your current directory.

Step 2: Generate Public Key

Create the corresponding public key using this command:

openssl rsa -pubout -in privkey_rsa2048.pem -outform PEM -out pubkey_rsa2048.pem

This generates a public key file named pubkey_rsa2048.pem.

Note: If your private key is encrypted (created with a passphrase), you'll be prompted to enter the passphrase during this step.

Step 3: Configure Snowflake User

Copy the content of your public key file (pubkey_rsa2048.pem)

1. Remove the header -----BEGIN PUBLIC KEY----- and footer -----END PUBLIC KEY-----
2. Remove all newline characters to create a single continuous string
3. Execute the following SQL command in Snowflake (replace username with your actual username and rsa_public_key with your processed public key:

ALTER USER username SET rsa_public_key='your_rsa_public_key_here';

Important: The public key string must not contain any line breaks or formatting characters.

Scenario A: Migrating Existing Connectors

Use this workflow when you have existing Snowflake connectors using username/password authentication that need to be migrated to key-pair authentication.

Step 1: Access Existing Connector

1. In Studio, navigate to the Integrations tab

2. Under Data Sources, locate the connector you want to migrate

3. Click View Details for that connector

Step 2: Edit Connection

1. A dialog will appear showing current connection details

2. Click Edit Connection

3. Review and acknowledge any warnings displayed

4. You'll be redirected to the Fivetran connection editing page

Step 3: Update Authentication Method

1. In the Auth segment, change the selection from USERNAME_PASSWORD to KEY_PAIR

2. This will reveal the Private Key input field:

Step 4: Configure Private Key

1. Open your private key file (privkey_rsa2048.pem)

2. Copy the entire content to your clipboard, including:

   • Header: -----BEGIN PRIVATE KEY-----

   • The key content

   • Footer: -----END PRIVATE KEY-----

3. Critical: Remove all newline characters to create a single continuous string

4. Paste the processed private key into the Private Key input box.
   Note: If the private key is encrypted, toggle on the “Is Private Key Encrypted?” and enter the Passphrase into the Passphrase input box.

Step 5: Save and Verify Migration

1. Save the updated connection

2. Test the connection to ensure the key-pair authentication is working correctly

3. Monitor the connector to ensure data sync continues without interruption

Scenario B: Creating New Snowflake Connector

Use this workflow when setting up a completely new Snowflake connector with key-pair authentication from the start.

Step 1: Access Studio Integrations

1. Open your Studio page

2. Navigate to the Integrations section

Step 2: Add New Data Source

1. Under Data Sources, locate the list of existing connectors

2. Click "Click here to add sources"

3. Select Snowflake from the data source options

4. Click Apply

Step 3: Configure the Connector

1. Click Set Up on the newly created connector

2. You'll be redirected to the Fivetran configuration page

3. Fill in the required connection details:

   • Host information

   • Username for the source database

   • Other connection parameters as needed

Step 4: Select Key-Pair Authentication

1. In the Auth segment, select KEY_PAIR from the authentication options

2. This will reveal the Private Key input field

Step 5: Configure Private Key

1. Open your private key file (privkey_rsa2048.pem)

2. Copy the entire content in your clipboard, including:

   • Header: -----BEGIN PRIVATE KEY-----

   • The key content

   • Footer: -----END PRIVATE KEY-----

3. Critical: Remove all newline characters to create a single continuous string

4. Paste the processed private key into the Private Key input box

Step 6: Complete Setup

1. Provide any remaining required details

2. Save the connection

3. Test the connection to ensure it works properly

Advanced Key Management (Optional)

Creating Encrypted Private Keys

For enhanced security, you can create password-protected private keys:

openssl genrsa -aes-256-cbc -out privkey_rsa2048_encrypted.pem 2048

This command will prompt you to create a passphrase for the private key.

Changing Key Passphrase

To change the passphrase of an existing private key:

openssl pkcs8 -topk8 -v2 des3 -in privkey_rsa2048_old.pem -out privkey_rsa2048_new.pem

Important Note: When changing a private key's passphrase, the corresponding public key remains unchanged. You do not need to update the public key in Snowflake when only the passphrase changes.

Troubleshooting

Common Issues and Solutions

Connection Failed:

• Verify that the public key was correctly added to the Snowflake user

• Ensure the private key format is correct (no extra newlines or characters)

• Confirm that the username matches exactly

Authentication Error:

• Check that the RSA key pair was generated correctly

• Verify that the public and private keys correspond to each other

• Ensure the Snowflake user has the necessary permissions

Format Issues:

• Double-check that header and footer lines are included for private keys

• Confirm that header and footer lines are excluded for public keys

• Verify that all newline characters have been removed

Testing Your Setup

Before finalizing the migration, test the connection using a Snowflake client with your new key-pair credentials to ensure everything works correctly.

Security Best Practices

1. Store private keys securely - Never share or expose private keys

2. Use encrypted private keys - Consider using passphrase protection for additional security

3. Regular key rotation - Plan to rotate keys periodically for enhanced security

4. Backup keys safely - Maintain secure backups of your key pairs

5. Monitor access - Keep track of which systems and users have access to your keys