PingOne

Provisioning Snowflake with PingOne

By using the Snowflake connection in PingOne, you can synchronize users between Snowflake and PingOne through inbound and outbound provisioning. The Snowflake connection also supports Snowflake roles and database roles at the connection level.

Provisioning capabilities

The following table summarizes the inbound and outbound provisioning capabilities for each resource type:

Resource Capability Description Inbound Outbound

User

Create

Generates a new user record in the destination.

Yes

Yes

Read

Retrieves or polls user attributes for synchronization.

Yes

Yes

Update

Modifies existing attributes, such as first name.

Yes

Yes

Delete

Deletes a user or temporarily suspends an account.

Yes

Yes

Group

Create

Provisions a new group in the target application.

No

No

Rename

Updates the display name or identifier of an existing group.

No

No

Delete

Removes a group from the target application.

No

No

Membership

Add and remove

Adds or removes users from groups.

No

No

Before you begin

Make sure that you have:

  • A Snowflake account. Learn more in create a Snowflake account.

  • An authorization token or the following JWT token details from your Snowflake account:

    • JWT PEM

    • JWT Expiration

    • JWT Algorithm

    • Key Algorithm

    • JWT Claims (JSON)

  • Users created and assigned to a group specifically for Snowflake provisioning in PingOne. Learn more in Adding a user in PingOne and Managing groups.

Steps

  1. Create a Snowflake connection:

    1. In the PingOne admin console, go to Integrations > Provisioning.

    2. Click and then click New Connection.

    3. Click Select for Identity Store.

    4. Click Select for the Snowflake connection, and click Next.

    5. Enter a Name and Description for this provisioning connection.

    6. Click Next.

    7. In the Configure Authentication section, select the Authentication Method to apply to your Snowflake account.

      Choose from:

      • For JWT_TOKEN, enter the following:

        Configuration Example

        JWT PEM

        MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDbt7EyGhPuI3Vf1XDmXcrc4…​

        JWT Expiration

        60

        JWT Algorithm

        RS256

        Key Algorithm

        RSA

        JWT Claims (JSON)

        { "iss": "RAEYFEY-XL55718.DEVINTEGRATION.SHA256:WIH3ctNrf3k/6qyY2ckX3uLiiMrswwcsCCpipP4yCEE=", "sub": "RAEYFEY-XL55718.DEVINTEGRATION" }

      • For TOKEN, enter the bearer token from your Snowflake account, such as eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.

    8. Click Next.

    9. In the User Actions section, enter the following as needed:

      Field Description

      Enable users creation

      Creates a user in the target identity store when the user is created in the source identity store.

      Enable users updation

      Updates user attributes in the target identity store when the user is updated in the source identity store.

      Enable users deprovision

      Deprovisions a user in the target identity store when the user is deprovisioned in the source identity store. If Enable users deprovision is selected, the following options appear:

      • Remove Action: Select Delete to remove a user in the target identity store when the user is deleted in the source identity store.

      • Deprovision on rule deletion: Deprovisions users if the associated provisioning rule is deleted.

    10. Click Save.

    11. To enable the connection, click the toggle at the top of the details panel to the right (blue).

      You can disable the connection by clicking the toggle to the left (gray).

  2. Create an inbound or outbound rule and select the existing Snowflake connection as the target or source. You can optionally add attribute mappings.

    Use the following inbound mapping examples for the Snowflake rule configuration:

    Snowflake PingOne Directory

    !disabled

    Enabled

    email

    Email Address

    last_name

    Family Name

    first_name

    Given Name

    name

    Username

    Use the following outbound mapping examples for the Snowflake rule configuration:

    PingOne Directory Snowflake

    Username

    name

    Given Name

    first_name

    !enabled

    disabled

    Email Address

    email

Validation

Confirm users and groups are successfully provisioned to Snowflake. View the sync status to review synchronization results and any errors. You can find examples in Outbound provisioning sync summary examples.

Snowflake directory attributes

The following table lists common Snowflake attributes that can be mapped for user provisioning:

Attribute Description

name

The Snowflake username attribute used for synchronization and required outbound username mapping.

email

The user email attribute used for synchronization and email mapping.

first_name

The user’s given name.

last_name

The user’s family name.

disabled

The Snowflake enabled or disabled state used in the current inbound and outbound mappings.

Snowflake provisioning known limitations

The PingOne username attribute is mapped to the name attribute in Snowflake. Because the name attribute in Snowflake is immutable, any updates to a user’s username in PingOne during outbound synchronization will fail to update the corresponding value in Snowflake.