You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "cruseakshay (via GitHub)" <gi...@apache.org> on 2026/02/19 10:33:30 UTC
[PR] Add PAT authentication support to SnowflakeSqlApiHook [airflow]
cruseakshay opened a new pull request, #62162:
URL: https://github.com/apache/airflow/pull/62162
## Problem
`SnowflakeSqlApiHook` (and by extension `SnowflakeSqlApiOperator`) had no
authentication path for Snowflake Programmatic Access Tokens (PATs).
This was reported in #62037, where users expected PAT auth to work
consistently across both `SnowflakeHook` (Python connector) and
`SnowflakeSqlApiHook` (REST API).
## Solution
Added a dedicated branch in `SnowflakeSqlApiHook.get_headers()` that:
- Detects `authenticator == "programmatic_access_token"` in the connection config
- Uses the connection `password` field as a `PROGRAMMATIC_ACCESS_TOKEN` bearer token
- Raises `AirflowException` with a clear message if the password field is empty
The auth priority order is preserved: OAuth → PAT → Key Pair JWT.
```
## Connection setup for PAT
conn_type : snowflake
login : <username>
password : <PAT value>
extra : {"account": "...", "authenticator": "programmatic_access_token", ...}
```
## Testing
- Added unit tests for the happy path and the missing-password error case
- Validated end-to-end against a live Snowflake account: both `SnowflakeHook`
(Python connector, PAT as password) and `SnowflakeSqlApiHook` (SQL REST API,
PAT bearer token) returned `state=success`
## Migration impact
No breaking changes. Existing Key Pair and OAuth connections are unaffected.
Fixes #62037
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add PAT authentication support to SnowflakeSqlApiHook [airflow]
Posted by "jroachgolf84 (via GitHub)" <gi...@apache.org>.
jroachgolf84 commented on PR #62162:
URL: https://github.com/apache/airflow/pull/62162#issuecomment-3928997655
@cruseakshay, looks like an LLM was used to assist in the development of this PR. Make sure that those guidelines are followed!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add PAT authentication support to SnowflakeSqlApiHook [airflow]
Posted by "cruseakshay (via GitHub)" <gi...@apache.org>.
cruseakshay commented on PR #62162:
URL: https://github.com/apache/airflow/pull/62162#issuecomment-3926377092
Tested with
```python
from __future__ import annotations
from airflow.sdk import DAG, task
SNOWFLAKE_CONN_ID = "snowflake_pat_test"
SNOWFLAKE_SQL_API_CONN_ID = "snowflake_pat_sql_api_test"
@task
def test_snowflake_hook():
"""SnowflakeHook with PAT as password"""
from airflow.providers.snowflake.hooks.snowflake import SnowflakeHook
hook = SnowflakeHook(snowflake_conn_id=SNOWFLAKE_CONN_ID)
result = hook.run("SELECT 1 AS pat_test", handler=lambda cur: cur.fetchone())
print(f"SnowflakeHook result: {result}")
return str(result)
@task
def test_sql_api_hook_execute_query():
"""SnowflakeSqlApiHook.execute_query() with PAT — SQL API REST path (fixed)."""
from airflow.providers.snowflake.hooks.snowflake_sql_api import SnowflakeSqlApiHook
hook = SnowflakeSqlApiHook(snowflake_conn_id=SNOWFLAKE_SQL_API_CONN_ID)
query_ids = hook.execute_query("SELECT 1 AS pat_sql_api_test", statement_count=1)
print(f"SnowflakeSqlApiHook query_ids: {query_ids}")
return str(query_ids)
with DAG(
dag_id="test_pat_auth",
schedule=None,
catchup=False,
):
test_snowflake_hook()
test_sql_api_hook_execute_query()
```
Connection:
```
snowflake_pat_sql_api_test:
conn_type : snowflake
login : <SNOWFLAKE_USER>
password : <PAT_TOKEN>
extra : {"account": "<ACCOUNT>", "warehouse": "<WH>", "database": "<DB>", "role": "<ROLE>",
"authenticator": "programmatic_access_token"}
```
test_sql_api_hook_execute_query **succeeded**:
```
::group::Log message source detailssources=["/opt/airflow/logs/dag_id=test_pat_auth/run_id=manual__2026-02-19T10:20:15.641057+00:00/task_id=test_sql_api_hook_execute_query/attempt=1.log"]
::endgroup::
[2026-02-19T10:20:15.839680Z] INFO - DAG bundles loaded: dags-folder
[2026-02-19T10:20:15.840034Z] INFO - Filling up the DagBag from /opt/airflow/dags/test_pat_auth.py
[2026-02-19T10:20:17.414518Z] INFO - Snowflake SQL POST API response: {'code': '333334', 'message': 'Asynchronous execution in progress. Use provided query id to perform query monitoring and management.', 'statementHandle': '01c283cc-0518-5147-0068-210107dd072b', 'statementStatusUrl': '/api/v2/statements/01c283cc-0518-5147-0068-210107dd072b'}
[2026-02-19T10:20:19.237278Z] INFO - SnowflakeSqlApiHook query_ids: ['01c283cc-0518-5147-0068-210107dd072b']
[2026-02-19T10:20:19.237610Z] INFO - Done. Returned value was: ['01c283cc-0518-5147-0068-210107dd072b']
[2026-02-19T10:20:19.237778Z] INFO - Pushing xcomti=RuntimeTaskInstance(id=UUID('019c756a-21a8-75b2-b388-08ee661ec881'), task_id='test_sql_api_hook_execute_query', dag_id='test_pat_auth', run_id='manual__2026-02-19T10:20:15.641057+00:00', try_number=1, dag_version_id=UUID('019c7563-2e48-7017-898f-9cc95dddc687'), map_index=-1, hostname='5dba0545637b', context_carrier={}, task=<Task(_PythonDecoratedOperator): test_sql_api_hook_execute_query>, bundle_instance=LocalDagBundle(name=dags-folder), max_tries=0, start_date=datetime.datetime(2026, 2, 19, 10, 20, 15, 824662, tzinfo=datetime.timezone.utc), end_date=None, state=<TaskInstanceState.RUNNING: 'running'>, is_mapped=False, rendered_map_index=None)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add PAT authentication support to SnowflakeSqlApiHook [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #62162:
URL: https://github.com/apache/airflow/pull/62162
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org