Configure Snowflake for UserLock Single Sign-On (SSO)

This guide explains how to integrate Snowflake with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once configured, Snowflake logins are authenticated by UserLock against Active Directory, enabling administrators to enforce UserLock access policies (MFA, time, machine, or location restrictions) on Snowflake sessions.

Unlike most Service Providers, Snowflake is not configured through a graphical form: the SAML settings are declared with a SQL command that creates a security integration.

1. Open the Snowflake console at https://app.snowflake.com.

2. Click +, select SQL File, then run:

   sql

   SELECT
     CURRENT_ORGANIZATION_NAME() AS ORG_NAME,
     CURRENT_ACCOUNT_NAME()      AS ACCOUNT_NAME;

3. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

4. In the application list, select Snowflake.

5. Complete the Snowflake profile:

   Settings	Values
   Application Domain	The account identifier only, in the form <org_name>-<account_name>. For example contoso-ab12345
   Email domain	Domain of the email addresses used to sign in. For example contoso.com
   Certificate	Leave empty unless you require Snowflake to sign its SAML requests

6. Save the profile

Your UserLock SSO URL is displayed in ⚙️ Server settings ▸ Single Sign-On. In this guide, <SSO_address> is that URL without the protocol. For https://sso.contoso.com, the SSO address is sso.contoso.com. If the URL uses a custom port, include it everywhere: https://sso.contoso.com:450 gives sso.contoso.com:450.

Retrieve the UserLock signing certificate first:

1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On.

2. Click Download ▸ SAML certificate.

3. Open the certificate in a text editor and copy the Base64 value.

Then run the following command as ACCOUNTADMIN, adapting the values to your environment:

CREATE SECURITY INTEGRATION userlock_sso
  TYPE = SAML2
  ENABLED = TRUE
  SAML2_PROVIDER = 'Custom'
  SAML2_ISSUER = 'https://sso.contoso.com'
  SAML2_SSO_URL = 'https://sso.contoso.com/saml/sso'
  SAML2_X509_CERT = 'MIICqzCCAZOgAwIBAgIIVS4f...wNxVfdfiKl7MeJ4XyJx'
  SAML2_SNOWFLAKE_ISSUER_URL = 'https://contoso-ab12345.snowflakecomputing.com'
  SAML2_SNOWFLAKE_ACS_URL = 'https://contoso-ab12345.snowflakecomputing.com/fed/login'
  SAML2_REQUESTED_NAMEID_FORMAT = 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
  SAML2_ENABLE_SP_INITIATED = TRUE
  SAML2_SP_INITIATED_LOGIN_PAGE_LABEL = 'UserLock SSO';

The five values to substitute:

UserLock sends the user's email address as the SAML NameID, and Snowflake matches that value against the user's LOGIN_NAME. A Snowflake user whose LOGIN_NAME does not match the email address sent by UserLock is rejected.

For each user who will sign in through SSO, set LOGIN_NAME to the email address held in Active Directory, in the domain configured in the UserLock profile:

CREATE USER jdoe
  LOGIN_NAME = 'jdoe@contoso.com'
  EMAIL = 'jdoe@contoso.com'
  DISPLAY_NAME = 'Jane Doe'
  FIRST_NAME = 'Jane'
  LAST_NAME = 'Doe'
  MUST_CHANGE_PASSWORD = FALSE
  DEFAULT_ROLE = PUBLIC;

To update an existing user, run ALTER USER jdoe SET LOGIN_NAME = 'jdoe@contoso.com';

Keep your existing Snowflake administrator session open while testing.

1. Open an incognito or private browser window.

2. Open your account URL, for example https://contoso-ab12345.snowflakecomputing.com.

3. Click UserLock SSO on the login page.

4. Authenticate through UserLock with an Active Directory account whose email address is in the configured Email domain and matches the LOGIN_NAME of an existing Snowflake user.

5. Confirm that the user reaches the Snowflake console with the expected role.

Snowflake password authentication remains available by default, which is what lets an administrator sign in when UserLock SSO is unreachable. Confirm the following before you enforce SSO:

• At least one ACCOUNTADMIN account has a Snowflake password that you know.

• That account is protected by Snowflake MFA.

• The account is exempt from any SAML-only authentication policy you apply, or the policy is applied to a role rather than to the whole account.

Creating the security integration does not disable password sign-in. Some environments require users to authenticate only through SSO. Snowflake enforces this with an authentication policy.

1. Confirm that SSO works end to end for the users concerned.

2. Create the policy:

   sql

   CREATE AUTHENTICATION POLICY saml_only_policy
     AUTHENTICATION_METHODS = ('SAML');

3. Apply it:

   sql

   ALTER ACCOUNT SET AUTHENTICATION POLICY saml_only_policy;

When you renew the UserLock SAML certificate, update Snowflake during Step 2. Update SaaS applications of the Renew the SAML certificate procedure.

1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On and click Download ▸ SAML certificate.

2. Open the certificate in a text editor and copy the Base64 value, without the header and footer lines and without line breaks.

3. Update the integration:

   sql

   ALTER SECURITY INTEGRATION userlock_sso SET
     SAML2_X509_CERT = 'MIICqzCCAZOgAwIBAgIIVS4f...wNxVfdfiKl7MeJ4XyJx';

4. Test a sign-in and confirm that authentication succeeds.

For common issues, see Troubleshooting SSO. If the problem persists, contact IS Decisions Support.

The NameID sent by UserLock matches no Snowflake user. Either the user has not been created in Snowflake, or the LOGIN_NAME does not match the email address held in Active Directory. See Match the Snowflake users to Active Directory.

UserLock found no email address on the authenticating Active Directory account matching the Email domain configured in the Snowflake profile. Check the mail and proxyAddresses attributes of the user, and the Email domain value in the profile. UserLock also sends this error by email to the SSO administrator.

SAML2_SNOWFLAKE_ISSUER_URL or SAML2_SNOWFLAKE_ACS_URL does not match your account URL exactly. Run the query in Step 1 again to confirm the account identifier, then correct the integration with ALTER SECURITY INTEGRATION.

SAML2_X509_CERT no longer matches the certificate used by UserLock to sign the SAML response, usually after a certificate renewal. See Update the SAML certificate in Snowflake. Confirm also that the value contains no header line, footer line, or line break.

SAML2_ENABLE_SP_INITIATED is not set to TRUE. Users cannot reach UserLock without it, since UserLock SSO does not support identity-provider-initiated authentication.

ALTER SECURITY INTEGRATION userlock_sso SET SAML2_ENABLE_SP_INITIATED = TRUE;

Sign in with the recovery administrator's Snowflake password, then disable the integration:

ALTER SECURITY INTEGRATION userlock_sso SET ENABLED = FALSE;

If a SAML-only authentication policy is applied, remove it first:

ALTER ACCOUNT UNSET AUTHENTICATION POLICY;

Re-enable the integration once UserLock SSO is reachable again.

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

• Apply MFA on SaaS connections to require stronger authentication.

• Hour restrictions: define when users are allowed to connect.

• Geolocation rules: enforce access policies based on user location.

• Session limits: allow or deny SaaS logins entirely for specific users.