You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@nifi.apache.org by Zaid Malik <za...@westmarine.com.INVALID> on 2025/10/14 16:10:16 UTC
Snowflake Blocking Single-Factor Password Authentication
Good Afternoon,
I had a question regarding Snowflake's shift to deprecate single-factor password authentication, at this time I did not see any information coming from Apache regarding how this will be handled within NiFi and was wondering if there is any guidance regarding how organizations should proceed after this occurs. Will the SnowflakeComputingConnection and StandardSnowflakeIngestManager services possibly be updated to allow for MFA before this happens, or should our organization switch to using a JDBC Driver to be able to connect to Snowflake? At this time our plan is to use key-pair authentication. Any information or guidance you could provide would help.
Thank you!
Zaid Malik
Data Engineer
zaidm@westmarine.com
[cid:c7924528-6e05-4914-b7c8-c9a83110de2d]
Re: Snowflake Blocking Single-Factor Password Authentication
Posted by Chris Debevec <ch...@gmail.com>.
FTW what i'm seeing with Snowflake is that they are requiring MFA for the
UI logins. If you assign the "user" on snowflake as a "service" account
they will be unable to reach the Snowflake UI but still be able to be a
password login via ODBC, JDBC, etc that snowflake would use to connect.
On Tue, Oct 14, 2025 at 11:11 AM Zaid Malik <za...@westmarine.com.invalid>
wrote:
> Good Afternoon,
>
> I had a question regarding Snowflake's shift to deprecate single-factor
> password authentication, at this time I did not see any information coming
> from Apache regarding how this will be handled within NiFi and was
> wondering if there is any guidance regarding how organizations should
> proceed after this occurs. Will the SnowflakeComputingConnection and
> StandardSnowflakeIngestManager services possibly be updated to allow for
> MFA before this happens, or should our organization switch to using a JDBC
> Driver to be able to connect to Snowflake? At this time our plan is to use
> key-pair authentication. Any information or guidance you could provide
> would help.
>
> Thank you!
>
> Zaid Malik
> *Data Engineer*
> zaidm@westmarine.com
>
Re: Snowflake Blocking Single-Factor Password Authentication
Posted by Kevin Doran <kd...@apache.org>.
Hi again Zaid,
I'd like to correct my previous email. I was mistaken, as these components
are maintained as part of the Apache NiFi open source project. My confusion
was because these components are not included by default in the open source
convenience binaries created for releases.
Regarding Snowflake's MFA requirement and these NiFi components:
- The MFA requirement only applies to passwords. If you generate a
Snowflake Personal Access Token (PAT) for a user account, you can use the
PAT in the password field of these components, and that should work without
MFA.
- The upcoming NiFi 2.7.0 release includes NIFI-15032 [1], which adds
support for key-pair authentication to the SnowflakeComputingConnectionPool
controller service, so once you upgrade to that version, your plan to
migration to Snowflake key-pair authentication in NiFi should be possible.
Hopefully this answers your question. David Handermann, who recently did
the work for NIFI-15032, may have additional insight on guidance. Again, my
apologies for the initial confusion and feel free to reach back out with
any additional questions.
[1] https://issues.apache.org/jira/browse/NIFI-15032
Cheers,
Kevin
On Tue, Oct 14, 2025 at 1:01 PM Kevin Doran <kd...@apache.org> wrote:
> Hi Zaid,
>
> Thanks for your question. I took a look, and if I understand correctly,
> the components you are referencing (SnowflakeComputingConnectionPool
> and StandardSnowflakeIngestManagerProviderService) are not Apache NiFi
> components that are built/maintained by the open source community, but
> rather NiFi extensions that are included in a vendor distribution of NiFi
> (Cloudera). My advice would be to work with your vendor / their support
> team to get guidance on their plans for updating their components to
> maintain compatibility with Snowflake, as the open source community here
> has no control over that.
>
> Cheers,
> Kevin
>
> On Tue, Oct 14, 2025 at 12:11 PM Zaid Malik <za...@westmarine.com.invalid>
> wrote:
>
>> Good Afternoon,
>>
>> I had a question regarding Snowflake's shift to deprecate single-factor
>> password authentication, at this time I did not see any information coming
>> from Apache regarding how this will be handled within NiFi and was
>> wondering if there is any guidance regarding how organizations should
>> proceed after this occurs. Will the SnowflakeComputingConnection and
>> StandardSnowflakeIngestManager services possibly be updated to allow for
>> MFA before this happens, or should our organization switch to using a JDBC
>> Driver to be able to connect to Snowflake? At this time our plan is to use
>> key-pair authentication. Any information or guidance you could provide
>> would help.
>>
>> Thank you!
>>
>> Zaid Malik
>> *Data Engineer*
>> zaidm@westmarine.com
>>
>
Re: Snowflake Blocking Single-Factor Password Authentication
Posted by Kevin Doran <kd...@apache.org>.
Hi Zaid,
Thanks for your question. I took a look, and if I understand correctly, the
components you are referencing (SnowflakeComputingConnectionPool
and StandardSnowflakeIngestManagerProviderService) are not Apache NiFi
components that are built/maintained by the open source community, but
rather NiFi extensions that are included in a vendor distribution of NiFi
(Cloudera). My advice would be to work with your vendor / their support
team to get guidance on their plans for updating their components to
maintain compatibility with Snowflake, as the open source community here
has no control over that.
Cheers,
Kevin
On Tue, Oct 14, 2025 at 12:11 PM Zaid Malik <za...@westmarine.com.invalid>
wrote:
> Good Afternoon,
>
> I had a question regarding Snowflake's shift to deprecate single-factor
> password authentication, at this time I did not see any information coming
> from Apache regarding how this will be handled within NiFi and was
> wondering if there is any guidance regarding how organizations should
> proceed after this occurs. Will the SnowflakeComputingConnection and
> StandardSnowflakeIngestManager services possibly be updated to allow for
> MFA before this happens, or should our organization switch to using a JDBC
> Driver to be able to connect to Snowflake? At this time our plan is to use
> key-pair authentication. Any information or guidance you could provide
> would help.
>
> Thank you!
>
> Zaid Malik
> *Data Engineer*
> zaidm@westmarine.com
>