Key-Pair Authentication for Snowflake Integration Credentials

Note:

The Advance Authentication Methods for Snowflake Integrations is under Public Preview. Please contact OneTrust Support to request early access.

OneTrust supports key-pair authentication so users can create key pairs and set expiration periods for Snowflake-based credentials. While password authentication is currently available until Snowflake ends support, this article will demonstrate how to configure key-pair authentication in response to Snowflake's upcoming changes and to provide a more secure approach for programmatic access that supports critical, existing integrations.

Important:

For information about rotating key pairs, see Rotating Key Pairs for Integration Credentials.

To create credentials

  1. On the Integrations menu, select Credentials.

    The Credentials screen appears.

  2. Click the Add credential button.

    The Select existing system screen appears.

  3. Enter your system in the Select System field, then click the Next button.


    The Enter Credential Details screen appears.

  4. Provide a unique name and meaningful description for this new credential.


  5. The Configuration Type field will default to Configure manually.
  6. Choose Database as the Application type.


  7. Select Snowflake from the Database type dropdown.


  8. Additional required fields will populate for you to provide information about your system, including:

    • Database host

    • User name

    • Database name

    • Database port

  9. Ensure the Authentication type field is set to Private key.
  10. For the Key pair field, you can select existing public keys or select the create option in the drop down.


  11. For creating a new public key pair, provide a unique name, expiration date, and key-pair algorithm. Click the Create button.
    Note:

    OneTrust supports expirations of 1, 2, and 3 years.

    RSA is the only supported algorithm for Snowflake key pairs.



  12. The new key pair will be added to the field. Use the copy icon to copy and document this generated public key pair.


  13. Click the Save button.

    The Credentials screen appears.

  14. Locate and select your new credential name.

    The Credential details screen appears.

  15. On the Details tab, you can copy at any time the full public key for sharing and storing the key in Snowflake.


  16. Assign the public key to the user. Set the public key value to either RSA_PUBLIC_KEY or RSA_PUBLIC_KEY_2, whichever key value is not currently in use. For example:
    CODE 
    ALTER USER ot-user
SET RSA_PUBLIC_KEY_2='<paste-public-key-from-onetrust';
  17. Once this is configured, you can use this credential to connect OneTrust to the actual account.
    Note:

    For more information, see Snowflake's Key-pair authentication and key-pair rotation.

FAQ

Where are the private keys stored?

Credentials are securely generated and stored within OneTrust using tenant-specific encryption. These are never exposed in the OneTrust application or transmitted over the network. OneTrust has implemented the storing of private keys based on customer feedback and security best practices.

What users can create key pairs?

Only users with the Credential edit permission can create key pairs.

What are the available expiration dates for key pairs?

OneTrust supports expiration dates of 1, 2, and 3 years.

How will I be notified about private key rotations?

Notification and rotation mechanisms for key pairs are in active development and targeted for upcoming quarters.

Can I reuse key pairs across tenant copies to other environments?

No. When tenants are copied between environments, users are required to regenerate credentials for security best practices.

Can I bring my own key pair for this authentication?

No, OneTrust-based key pairs must be created for this type of authentication.