Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation.
7,511 questions
Dataiku - Snowflake Entra ID authentication: The application asked for scope that doesn't exist on the resource
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 82%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDL%3C/text%3E%3C/svg%3E)
Daria Lisita
0
Reputation points
I am configuring OAUTH to authorize Dataiku developers in Snowflake using external OAUTH on Entra ID.
In the Dataiku documentation i have information:
Fill the scope with the operations and roles permitted for the access token (This depends on your OAuth Server so check the official doc). Or if you do not want to manage Snowflake roles in your OAuth2 server, pass the static value of SESSION:ROLE-ANY in the scope.
Also in snowflake documentation mentioned that SESSION:ROLE-ANY is applicable.
When I've configured server APP in Entra Id and added scope to API exposure.
Then I granted permissions to it in the client app.
But now when I try to authorize in Snowflake through Dataiku, i receive an error:
The application 'snowflake oauth client for DSS users (for person user)' asked for scope 'session:role-any' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'.
What can be the reason? Or where i can check what it can be?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 30%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGP%3C/text%3E%3C/svg%3E)
Goutam Pratti 1,150 Reputation points Microsoft Vendor2024-12-23T09:26:22.29+00:00 Hello @Daria Lisita ,
Thank you for reaching out Microsoft Q&A.
I understand you are getting an error: The application 'snowflake oauth client for DSS users (for person user)' asked for scope 'session: role-any' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'.
To configure ANY role, define the scope as
SESSION:ROLE-ANYand configure the security integration with theexternal_oauth_any_role_modeparameter. This parameter can have three possible string values:-
DISABLEdoes not allow the OAuth client or user to switch roles (i.e.use`` ``role`` ``<role>;). Default.
ENABLEallows the OAuth client or user to switch roles.-
ENABLE_FOR_PRIVILEGEallows the OAuth client or user to switch roles only for a client or user with theUSE_ANY_ROLEprivilege. This privilege can be granted and revoked to one or more roles available to the user. For example:grant USE_ANY_ROLE on integration external_oauth_1 to role1;revoke USE_ANY_ROLE on integration external_oauth_1 from role1;
Define the security integration as follows:
create security integration external_oauth_1 type = external_oauth enabled = true external_oauth_any_role_mode = 'ENABLE' ...For additional information: https://docs.snowflake.com/en/user-guide/oauth-azure#using-any-role-with-external-oauth
Hope this helps. Do let us know if you any further queries.
Regards,
Goutam Pratti. -
-
Goutam Pratti 1,150 Reputation points Microsoft Vendor
2024-12-24T05:06:08.57+00:00 Hello @Daria Lisita ,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Sign in to comment
Sign in to answer