Skip to content
AstratoAstratoAstrato

Administrator or above

Identity federation with Snowflake

4 min read · Updated 6 Nov 2026

Identity federation sets up a trust between Astrato and your Snowflake account, so each person reads Snowflake data as their own Snowflake user and Snowflake’s access rules apply to them. You manage it on the Identity federation tab of Administration → Enterprise Connection.

There are two kinds, shown in the Federation column of the list:

  • Astrato broker: Astrato signs a token for each person, and Snowflake checks it against Astrato’s published signing key. Choose Snowflake when you add it.
  • Token exchange: a token from your Microsoft Entra ID sign-in is used for Snowflake. Choose Entra ID Token Exchange when you add it. It is offered only once the workspace has a Microsoft Entra ID login connection.

Login connections and access integrations are on the other two tabs. See Enterprise connections.

Before you start

Section titled “Before you start”
  • You have the Owner or Admin role.
  • You can create a security integration in Snowflake, which needs a privileged Snowflake role.
  • You know your Snowflake account URL, for example https://account.snowflakecomputing.com.
  • For token exchange: the workspace has a Microsoft Entra ID login connection, and you know the token audience your Entra ID app uses for Snowflake.

Add a federation provider

Section titled “Add a federation provider”
  1. Open Administration → Enterprise Connection and select the Identity federation tab.
  2. Select Add provider, then choose Snowflake or Entra ID Token Exchange under Select a Service provider.
  3. The Configuration tab lists the values the federation uses: Scope mapping attribute scp, Scope session:role-any and a User mapping claim, which is sub for Snowflake and email for token exchange. Snowflake also lists Encryption algorithm RS512. Select Continue to Setup.
  4. Enter a Display name and the Service account URL, your Snowflake account URL. For token exchange, also choose the Entra ID login connection under SSO connection and enter the Token audience.
  5. Select Create. The new provider appears in the list and its properties open.

Next, register Astrato in Snowflake. For an Astrato broker federation, open the provider’s Configuration tab. It shows the JSON Web Key Sets URL, which lets Snowflake find a new verification key after the signing key is rotated, and the Public key when one is available. Each has a Copy button. Use them with the values from step 3 to create an External OAuth security integration in Snowflake. Snowflake documents the options in CREATE SECURITY INTEGRATION (External OAuth).

The integration also needs EXTERNAL_OAUTH_ISSUER, the issuer Astrato signs its tokens with. This tab does not show it, so ask Astrato support for your workspace’s issuer before you create the integration. Identity Federation in Snowflake using External OAuth shows a complete statement. It was written for the earlier administration screens, which showed the issuer on the Configuration tab.

A token exchange federation’s Configuration tab shows its scope mapping attribute, scope, user mapping claim and token audience. For the Entra ID and Snowflake setup it relies on, see the Entra ID and Snowflake federated identity setup guide.

Check that it works

Section titled “Check that it works”

On the provider’s Setup tab, the Verification section has Generate test token. Select it to issue a test access token, then copy it with Copy. In Snowflake, you can check the token with SYSTEM$VERIFY_EXTERNAL_OAUTH_TOKEN.

Edit a provider or rotate its key

Section titled “Edit a provider or rotate its key”

Select a provider, or its Edit button, to open its properties. They open on Configuration.

  • Edit: on Setup, under General, you can change the Display name and the Service account URL, then select Save. Other settings cannot be changed here.
  • Rotate the signing key: an Astrato broker federation has a Signing key section. Select Rotate & Revoke and confirm to replace the signing key. Tokens signed with the previous key stop working. Snowflake finds the new key through the JSON Web Key Sets URL.
  • Delete: under Danger zone, select Delete federation and confirm. This deletes the federation setup and disconnects every linked account. It cannot be undone.

Review and delete people’s tokens

Section titled “Review and delete people’s tokens”

The Tokens tab lists one token for each person who has signed in through this federation, with their Name, Email and when the token was Refreshed at. Until anyone signs in through it, the tab reads No tokens.

  • Search with Search by email or name. Select a column heading to sort by it.
  • The list loads 25 tokens at a time. Select Load more tokens to see the rest.
  • To remove one person’s token, select Delete on their row and confirm. They must sign in again before they can read data through this federation. Their Astrato account is not affected.

When something cannot be read

Section titled “When something cannot be read”

If the provider list, a provider’s setup or its tokens cannot be read, Astrato shows Federated identity providers unavailable, Federation setup unavailable or Tokens unavailable with the reason and a way to retry, rather than an empty list.

What next

Section titled “What next”