Looking for the previous version? View v2024.06 documentation →
Snowflake JDBC Connection — Private Key Authentication
Create a Snowflake JDBC connection profile using key-pair (private key) authentication instead of a username and password.
Overview
Data Trust supports key-pair authentication for Snowflake JDBC connections. Instead of supplying a username and password, you can authenticate using a Private Key file and an optional passphrase. This is the recommended method for service accounts and automated pipelines because it avoids storing plaintext passwords.
Prerequisites
- You are logged in to Data Trust with an Admin Pro-User role.
- You have generated an RSA key pair for Snowflake key-pair authentication and registered the public key with your Snowflake user.
- The private key file (
.p8or PEM format) is accessible on the Data Trust server. - You have a Snowflake JDBC connection string.
Creating a Snowflake JDBC Connection with Private Key
Path: Data Trust › Admin Console › Connection Explorer › + New ConnectionFigure 1: Navigate to Admin Console › Connection Explorer to manage connection profiles.
Open the Connection Explorer from the left-hand Admin Console menu to see all existing connection profiles.
Figure 2: Connection Explorer — click “+ New Connection” to start creating a Snowflake private-key profile.
The Connection Explorer lists all profiles. Click + New Connection in the top-right to open the Create Connection form.
- Click + New Connection.
Figure 3: Click “+ New Connection” to open the connection creation form.
The + New Connection button opens the Create Connection page where you specify the connection name, source, and parameters.
- Enter a unique Connection Name.
- Select Snowflake from the Source Name dropdown.
- Select JDBC as the Type Of Connection.
Figure 4: Create Connection page — Snowflake selected as Source Name with JDBC connection type, showing the standard JDBC fields.
Selecting Snowflake as the Source Name and JDBC as the Type Of Connection reveals the Snowflake JDBC-specific fields: Connection String, User Name, Password, Driver Class, Default Enclosure Character, Private Key checkbox, Private Key Path, and Passphrase. The Private Key fields are greyed out until the checkbox is enabled.
- Fill in the Connection String (Snowflake JDBC URL, e.g.,
jdbc:snowflake://account.snowflakecomputing.com/?db=mydb&schema=public&role=myrole&warehouse=mywarehouse). - Enter the Snowflake User Name associated with the key-pair.
- Leave Password blank (key-pair authentication does not use a password).
Figure 5: Snowflake JDBC connection parameters — Connection String, User Name, Driver Class, and the Private Key section (checkbox and greyed-out path/passphrase fields).
The Snowflake JDBC form shows standard fields at the top and the Private Key section below. The Private Key checkbox is unchecked by default, keeping the Private Key Path and Passphrase fields disabled. Leave the Password field blank when using key-pair authentication.
- Tick the Private Key checkbox to enable the key-pair fields.
Figure 6: Private Key section with checkbox unchecked — Private Key Path and Passphrase fields remain disabled until the checkbox is ticked.
The Private Key checkbox acts as an on/off toggle for the key-pair authentication mode. When unchecked, password-based authentication is used and the Private Key Path and Passphrase fields are non-interactive.
- Enter the full server path to your private key file in Private Key Path (e.g.,
/opt/datatrust/keys/snowflake_rsa_key.p8). - If your private key is encrypted, enter the decryption Passphrase. Leave blank for unencrypted keys.
Figure 7: Private Key checkbox ticked — Private Key Path and Passphrase fields are now active and ready for input.
With the Private Key checkbox ticked, the Private Key Path and Passphrase fields become editable. Enter the full absolute path to the .p8 private key file on the Data Trust server, and the passphrase if the key is encrypted. Data Trust will use these for key-pair authentication when connecting to Snowflake.
- Click Test Connection to verify key-pair authentication works correctly.
- Click Save to create the profile.
ALTER USER myuser SET RSA_PUBLIC_KEY='...';