OneTrust Consent Management App for Snowflake

In order to configure the Snowflake's OneTrust Consent Management Native App integration, please ensure you have at least one purpose and one collection point created in the OneTrust platform before proceeding.

1. Sign in to your Snowflake account.

2. Navigate to Data Products > Apps.

   
   
   

3. Click the Open app icon to open the OneTrust Consent Management app or click here to access.

4. The OneTrust Consent Management screen appears.

5. Follow the on-screen instructions to install the OneTrust Consent Management app.

1. The OneTrust Consent Management screen appears on the Home menu.

   
   
   

2. Click the Grant warehouse privileges and Grant account privileges buttons to enable the permissions required by the app. Accept the two modals that appear clicking Save and Grant Privileges.

   
   
   
   
   

   Note:

   A message appears informing that privileges have been successfully granted.

   
   
   

3. Click Proceed to Initialization.

4. You can see the How does it work?, Before using, Initialization steps, Limitations, and After setup collapsible sections to know more details about the OneTrust Snowflake Integration App.

1. Navigate to the Initialization menu. The Installation section appears.

   
   
   
   Note:

   You can optionally customize the Database Name, Snowflake share name, and External access integration name fields.

   By default, the following names are used:

   • Database Name: OT_CONSENT_APP

   • Snowflake share name: DSCONSENT_SHARE

   • External access integration name: OT_INTEGRATION

2. Click the Install app button to install the app components.

3. Click the Next button.

4. Follow the instructions in the Credentials section.

   
   
   

5. Hover over the command and click the Copy to clipboard icon at the top right corner.

6. Outside of the Native App, navigate to Projects > Worksheets. Paste and execute the script from step 5 opening a new Snowflake tab on your browser.

7. In the top right corner, click the Plus icon to add a new SQL Worksheet.

   
   
   

8. Paste the copied command, select all the lines of the script, and execute it clicking the Play icon.

   
   
   

9. When finished, go back and check the checkbox labeled Command code executed. Click Next.

   Note:

   The initialization has been completed.

10. On the Environment section, enter the API key generated from OneTrust and the URL for your OneTrust environment without adding the "https://www." part. For example, uat.onetrust.com.

    Note:

    For more information see, Create an API Key and About OneTrust Hosting Options, Locations, and Backup.

    Select an option in the Default metadata sync interval (can be adjusted later) field to configure the time interval used by OneTrust’s Native App to fetch metadata from OneTrust UCPM.

    Note:

    By default, metadata is retrieved every 2 hours. However, this interval can be configured up to 12 hours. For instance, if the application is not actively used, increasing this interval may help delay the warehouse startup, optimizing resource usage.

    
    
    

11. Optionally, you can click the Need help? section for more information on how to set up the environment.

    
    
    

12. Click the Save and Test Connection button. Then, click Next.

    Note:

    An Environment connected message appears.

13. The Connect section appears. Follow the instructions on step 4/6 of the procedure. Check the checkbox labeled JSON successfully uploaded into OneTrust and click Next.

    
    
    

14. Click the Need help? section for more information on how to create custom integrations.

    
    
    
    Note:

    You can specify the Warehouse Name and the Database Role optional attributes for troubleshooting purposes.

15. Expand the two collapsible sections under Please import the following JSON in OneTrust Integrations in order to receive Consent updates and click the Copy to clipboard icon to paste the code into a text editor. Save the documents as .json files to your computer with suitable names. These will be used in to import workflows to OneTrust.

16. Click the Next button.

    Note:

    You can use the information from steps 18. to 21. to build a new Snowflake integration in the OneTrust platform.

    Skip the steps below if a Snowflake integration already exists.

17. Follow the examples in the Establishing Authorization between Snowflake and OneTrust section to learn how to establish an authorization between the two platforms. Check the checkbox labeled Authorization Completed and click Next.

    Important:

    Refresh tokens issued by the OAuth 2.0 Authorization Code flow will expire and are not automatically renewed. Refresh tokens stored in OneTrust must be manually regenerated via the same Authorization Code flow prior to or upon expiration. Snowflake allows a maximum refresh token lifespan of 90 days. You can request Snowflake to extend the default maximum refresh token duration from 90 days to up to 1 year. For detailed instructions, see Snowflake's OAuth FAQ.

    
    
    

18. Navigate to Projects > Worksheets to run the command below as an ACCOUNTADMIN to create a new OAuth integration.

    CODECopy

    CREATE OR REPLACE SECURITY INTEGRATION ONETRUST_NATIVE_APP TYPE = OAUTH ENABLED = TRUE OAUTH_CLIENT = CUSTOM OAUTH_CLIENT_TYPE = ‘CONFIDENTIAL’ OAUTH_REDIRECT_URL = ‘https://uat.onetrust.com/integrationmanager/api/v1/tokens/callback’ OAUTH_ISSUE_REFRESH_TOKENS = TRUE OAUTH_REFRESH_TOKEN_VALIDITY = 7776000 ;

    CREATE OR REPLACE SECURITY INTEGRATION ONETRUST_NATIVE_APP
    TYPE = OAUTH
    ENABLED = TRUE
    OAUTH_CLIENT = CUSTOM
    OAUTH_CLIENT_TYPE = ‘CONFIDENTIAL’
    OAUTH_REDIRECT_URL = ‘https://uat.onetrust.com/integrationmanager/api/v1/tokens/callback’
    OAUTH_ISSUE_REFRESH_TOKENS = TRUE
    OAUTH_REFRESH_TOKEN_VALIDITY = 7776000 ;

    Note:

    Replace "uat" in the OAUTH_REDIRECT_URL with your OneTrust environment. For more information, see Snowflake's official documentation Create security integration.

    You can also replace the example name used above (ONETRUST_NATIVE_APP) based on your organizational needs.

19. Once the integration is created, execute the following command with the integration name used on step 18. and note the 'OAUTH_CLIENT_ID', 'OAUTH_AUTHORIZATION_ENDPOINT', and 'OAUTH_TOKEN_ENDPOINT' values.

    CODECopy

    DESC INTEGRATION ONETRUST_NATIVE_APP;

    DESC INTEGRATION ONETRUST_NATIVE_APP;

20. Execute the following command with the integration name used on step 18. and note the value for 'OAUTH_CLIENT_SECRET'.

    CODECopy

    SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('ONETRUST_NATIVE_APP' );

    SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('ONETRUST_NATIVE_APP' );

21. Set Up your Credentials

    1. In the OneTrust platform, navigate to Integrations > Credentials The Credentials screen appears.

    2. Click the Add credential button.

    3. In the Select existing system field, select Snowflake from the list. Click the Next button.

    4. The Create credentials screen appears.

       
       
       

    5. In the Credential name field, enter a name to identify the credentials.

    6. Select Configure manually in the Configuration type field.

    7. Select Web App in the Application type field.

    8. Select OAuth 2.0 in the Authentication method field.

    9. Select Authorization code in the Grant type field.

    10. Enter your Snowflake account URL in the Auth URL field received from OAUTH_AUTHORIZATION_ENDPOINT.

        Note:

        Snowflake does not support underscores in the Auth URL. If you need assistance, please contact Snowflake Support or try replacing them with hyphens.

        For more information, see Snowflake's official documentation Connecting with a URL. For Auth URL examples, refer to this page.

    11. Enter your Snowflake Access token URL into the Access token URL field. This corresponds to information received from OAUTH_TOKEN_ENDPOINT.

        Note:

        For Access token URL examples, refer to this page.

    12. Enter your Client ID and Client secret.

    13. Optionally, enter any scopes if required.

        Note:

        For more information about supported scopes, see the Scopes section in Snowflake's official documentation External OAuth overview.

    14. Click the Generate Token button. This opens a new modal prompting you to log in to Snowflake and grant permissions.

        
        
        

    15. Once authentication is successful and received, the Access Token and Refresh Token fields will be populated.

    16. Click the Save button.

        Note:

        For more information, see Configuring Integration Credentials and Using OAuth Grant Types in OneTrust Integrations.

22. Import an Integration Workflow

    1. In the OneTrust platform, navigate to Universal Consent & Preference Management > Interfaces > Native Integrations. The Native integrations screen appears.

    2. Click the Advanced Integrations button. The Integrations gallery screen appears. Select Integrations.

    3. Click the Import button. The Import modal appears.

       
       
       

    4. Complete the fields as needed.

    5. Click the Add button.

    6. Click the name of the integration you have created. The Integration details screen appears.

    7. Click the Context Menu icon. Select the Test integration option.

    8. When your workflow is ready, click the Activate button to enable it.

       Note:

       For more information, see Creating Integration Workflows and Managing Custom Integration Workflows.

23. Back in Snowflake, grant the Snowflake's OAuth 2.0 user's role (user created to establish authorization between OneTrust and Snowflake) additional permission to use the role created in Snowflake. The OneTrust platform creates an APP_PUBLIC role.

    CODECopy

    USE ONETRUST_CONSENT_MANAGEMENT; GRANT APPLICATION ROLE APP_PUBLIC TO ROLE <role_name>;

    USE ONETRUST_CONSENT_MANAGEMENT;
    GRANT APPLICATION ROLE APP_PUBLIC TO ROLE <role_name>;

24. The optional Syncing historical data (optional) section appears.

    Note:

    Importing historic data is expected to be performed only once. To proceed with this import, see Snowflake's official documentation Installing Snowflake CLI and our Bulk Export APIs.

    For more information on how to import your historical data from OneTrust to Snowflake, see the Import Historical Consent Data to Snowflake recipe in our Developer Portal.

    
    
    

25. Click the Finish button to continue.

If you want to share data coming in from OneTrust directly with third-party partners to allow them to have access to the same data, see step 1. below to add their Snowflake account information. For more information, see Step 5: Access and Masking Policies to configure policy masking to restrict visibility of specific data.

1. On the Data model and metadata menu, select Account List from the list. Hover over any row under the ACCOUNT_ID and the NAME columns. Enter the account locator for the Snowflake account you want to add and its name. The Plus icon appears. Click it to add the new values. For more information see Snowflakes' official documentation Account identifiers.

   
   
   
   Note:

   The list for the Account List component is editable.

   
   
   

   The following icons are available for use in the table:

   
   
   

   • Plus icon - Click it to add a row.

   • Download icon - Click it to download the list as a .csv file.

   • Search icon - Click it to search for an item in the list.

   • Fullscreen icon - Click it to go fullscreen view.

   Click the Update Account List button.

2. On the Data model and metadata menu, select Purposes from the list. Select Universal Consent and Preference Management, CMP, or All from the Purpose Type field. The list will display all the purposes that are returned via the OneTrust API integration.

   
   
   
   Note:

   The Purposes list is read-only. Any changes to purposes must be made in the OneTrust platform.

3. On the Data model and metadata menu, select Data Elements from the list. The list will display all the data elements that are returned via the OneTrust API integration.

   
   
   
   Note:

   The Data Element list is read-only. Any changes to data elements must be made in the OneTrust platform.

4. On the Data model and metadata menu, select Metadata Sync History from the list. The list will display a log of API requests to OneTrust to sync the data model.

   
   
   
   Note:

   The Metadata Sync History list is read-only. Any issues with API connectivity when retrieving purposes and data elements will be highlighted in this page.

You can configure customized masking policies using the My Roles tab to control access to roles for the current Snowflake account. If, on the other hand, you want to make this data available to other accounts, select Other Accounts to define the rules to start sharing data with partners. You will need to use the corresponding account IDs that were previously added to the Account List.

SELECT * FROM OT_CONSENT_APP.APP_DATA.DATASUBJECT_CONSENT_VIEW;