Connecting to Snowflake

For information on the available WHL files for supported environments, and how to install the appropriate file for your Python distribution, see Package Installation.

For information on the module to import, and how to configure the necessary connection properties in a connection string, see Establishing a Connection.

Other available connection properties can be used to configure other aspects of the connector capabilities.

Python Version Support

The CData Python Connector for Snowflake can be installed and used in Python 3.10 or newer.

Snowflake Version Support

The connector enables standards-based access to all Snowflake editions. You can authenticate with a Snowflake user, SSO, or SSL client authentication. After authenticating, you can execute standard SQL queries to Snowflake tables or set QueryPassthrough to use any of the available Snowflake SQL syntax. For example, you can use extended projection to project columns over semistructured data.

See Also

• Using the Connector: Establish connections and query Snowflake through Python code.
• From SQLAlchemy: Use SQLAlchemy to establish a connection with dialect URL, and interact with Snowflake data using mapped classes and Sessions.

Dependencies

The Python connectors require that Python 3.10 or newer be installed.

Installation

The CData Python Connector for Snowflake is available as a WHL file for Windows, Linux, and Mac. Each connector is built using the Python 3.10 Stable ABI (indicated by the abi3 tag in the filename), so a single wheel supports any Python 3.10 or newer installation — there is no need to match your exact Python minor version. Use the "pip install" command with the appropriate WHL file for your platform.

Windows:

pip install cdata_snowflake_connector-26.0.9655-cp310-abi3-win_amd64.whl

Linux:

pip install cdata_snowflake_connector-26.0.9655-cp310-abi3-linux_x86_64.whl

macOS:

pip install cdata_snowflake_connector-26.0.9655-cp310-abi3-macosx_12_0_arm64.whl

The macOS wheel supports arm64 (Apple Silicon) architectures only on macOS 12 and newer.

Regardless of the environment, certain distributions might require that the "pip3 install" command be used instead, to differentiate from a Python 2 distribution that might exist already. After installation, confirm whether the connector is successfully installed by running the "pip list" command. If "cdata_snowflake_connector" is present in the list output by the command, then the installation was successful.

Upgrading

When upgrading, "pip install" does not automatically clean up old JRE files. To avoid leftover files that could cause JVM errors, uninstall the previous version before installing the new one.

Licensing

After the installation is complete, a separate step is needed to activate a license for the connector. Among the CData assets in the distribution's site packages, there is an install-license tool that activates this license. From within the distribution's site-packages folder, after navigating to the "cdata/installlic_snowflake" folder, simply use a command like the below to activate the license. Omitting the <key> argument activates a trial license:

• Windows:
  

  ./install-license.exe <key>

• Linux / Mac:
  

  ./install-license.sh <key>

Sometimes, file access issues may cause pip to install the connector in a fallback file path that is not the python distribution's main or primary site-packages location. This can make it difficult to find where the connector was installed, and from there, the license activator. In that event, this python script below will print out the full file path of the connector's native file. This file will be stored in the mentioned cdata folder, from which the installlic_snowflake folder is trivial to find:

import os
import cdata.snowflake
path = os.path.abspath(cdata.snowflake.__file__)
print(path)

Uninstallation

If the connector needs to be uninstalled for any reason, do so by running the pip uninstall command, as in the example below:

pip uninstall cdata-snowflake-connector

The objects available within our connector are accessible from the "cdata.snowflake" module. To use the module's objects directly:

1. Import the module as follows:
   

   import cdata.snowflake as mod

2. To establish a connection string, call the connect() method from the connector object using an appropriate connection string, such as:
   

   mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

Connecting to Snowflake

Before authenticating, set the following properties to define your Snowflake connection:

• URL: Your Snowflake URL, such as https://orgname-myaccount.snowflakecomputing.com.
  • If using a Legacy URL: https://myaccount.region.snowflakecomputing.com.
  • To find your URL:
    1. Click on your name in the lower left-hand corner of your Snowflake UI.
    2. Hover over your Account ID.
    3. Click the Copy Account URL icon to copy your account URL.
• Database (optional): Restrict the tables and views exposed by the connector to those from a specific Snowflake database.
• Schema (optional): Restrict the tables and views exposed by the connector to those from a specific Snowflake database schema.

Authenticating to Snowflake

The connector supports OAuth authentication by default and also provides several options for federated identity providers and key-based login.

To specify the authentication method you want to use, set the AuthScheme property.

OAuth

To authenticate with OAuth, set the AuthScheme to OAuth.

To complete OAuth authentication, see Creating a Custom OAuth App. Then configure the following connection properties:

• OAuthClientId: Set to the Client ID of your registered OAuth application.
• OAuthClientSecret: Set to the Client Secret for the registered application.
• CallbackURL: Set to the redirect URI configured in your OAuth app settings.

The connector also supports additional OAuth-based authentication schemes for specific Identity Providers. These schemes extend the standard OAuth configuration and support either browser-based login or headless authentication. Depending on your identity provider, the following additional OAuth-based authentication schemes are supported. Set the AuthScheme to one of the following values and configure the required properties.

• AuthScheme=OAuthAzureAD: Performs non-browser OAuth authentication using Entra ID. Snowflake's security integration type is external_oauth.
  • OAuthClientId: Set to the Entra ID application's Client ID.
  • OAuthClientSecret: Set to the Entra ID application's Client Secret.
  • CallbackURL: Set to the Redirect URI configured in your Entra ID app.
  • AzureTenant: Set to your Entra ID Tenant ID.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=OAuthClientAzureAD: Uses the client credentials grant flow with Entra ID. No browser required.
  • OAuthClientId: Set to the Entra ID application's Client ID.
  • OAuthClientSecret: Set to the Entra ID application's Client Secret.
  • AzureTenant: Set to your Entra ID Tenant ID.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=OAuthOkta: Performs OAuth authentication with Okta as the Identity Provider.
  • OAuthClientId: Set to the Client ID of your Okta app.
  • OAuthClientSecret: Set to the Client Secret for your Okta app.
  • CallbackURL: Set to the Redirect URI configured in your Okta app.
  • OAuthAuthorizationURL: Set to the authorization URL for the OAuth service.
  • OAuthAccessTokenURL: Set to the URL to retrieve the OAuth access token from.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=OAuthClientOkta: Uses the client credentials grant flow with Okta. No browser required.
  • OAuthClientId: Set to the Client ID of your Okta app.
  • OAuthClientSecret: Set to the Client Secret for your Okta app.
  • OAuthAuthorizationURL: Set to the authorization URL for the OAuth service.
  • OAuthAccessTokenURL: Set to the URL to retrieve the OAuth access token from.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=OAuthOther: Performs OAuth authentication using a third-party Identity Provider, such as PingFederate.
  • OAuthClientId: Set to the Client ID from your IdP.
  • OAuthClientSecret: Set to the Client Secret from your IdP.
  • CallbackURL: Set to the Redirect URI defined in your OAuth configuration.
  • OAuthAuthorizationURL: Set to the authorization URL for the OAuth service.
  • OAuthAccessTokenURL: Set to the URL to retrieve the OAuth access token from.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=OAuthClientOther: Uses the client credentials grant flow with a third-party Identity Provider such as PingFederate. No browser required.
  • OAuthClientId: Set to the Client ID from your IdP.
  • OAuthClientSecret: Set to the Client Secret from your IdP.
  • OAuthAuthorizationURL: Set to the authorization URL for the OAuth service.
  • OAuthAccessTokenURL: Set to the URL to retrieve the OAuth access token from.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=OAuthJWT: Performs OAuth authentication using a signed JWT and a certificate. This scheme is typically used with Entra ID and other IdPs that support JWT-based assertion.
  • OAuthJWTCert: Path to the certificate file (.pfx or .pem) used to sign the JWT.
  • OAuthJWTCertType: The format of the certificate file (PEM, PFX).
  • OAuthClientId: The Client ID for your OAuth application.
  • OAuthClientSecret: (Optional) The Client Secret, if required by your IdP.
  • AzureTenant: (If using Entra ID) Set this to your Entra ID Tenant ID.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.
• AuthScheme=AzureMSI: Performs OAuth authentication using Azure Managed Identity (MSI). This method is ideal for applications running in Azure-hosted environments such as Azure App Services and virtual machines.
  • AzureResource: Set to the target resource ID as required by your Snowflake security integration.
  • OAuthClientId: (optional) The Client ID of your user-assigned managed identity.
  • InitiateOAuth: Set to GETANDREFRESH to automatically retrieve and refresh the access token.

Configuring External OAuth for Entra ID

The OAuthAzureAD and OAuthClientAzureAD schemes use Snowflake's External OAuth, with Microsoft Entra ID as the Identity Provider (IdP). Unlike a custom OAuth app (see Creating a Custom OAuth App), where Snowflake itself issues the access tokens, External OAuth configures Snowflake to trust and validate tokens issued by Entra ID. Before you connect, an account administrator must register an Entra ID application and create an External OAuth security integration in Snowflake.

Complete the following steps:

1. Register an Entra ID application. If you do not already have one, create an Entra ID application that exposes Snowflake as an OAuth resource and registers an OAuth client. For the full procedure, see Configure Microsoft Entra ID for External OAuth in the Snowflake documentation. Note the application's Client ID, a Client Secret, and your Tenant ID. You supply these values in OAuthClientId, OAuthClientSecret, and AzureTenant.
2. Obtain the issuer URL. In the application's Endpoints, open the Federation metadata document and copy the entityID value. This value is the issuer used in the security integration and resembles https://sts.windows.net/your-tenant-id/. Include the trailing slash.
3. Map Snowflake users to Entra ID identities. The required mapping depends on the grant type:
   • OAuthAzureAD uses the authorization code grant, so the access token represents the signed-in user. Ensure that a Snowflake user exists whose login name matches the user's Entra ID username.
   • OAuthClientAzureAD uses the client credentials grant, so the access token represents the application itself. Create a Snowflake user whose login name matches the Entra ID application's Client ID.
4. Create the security integration. Only account administrators (users with the ACCOUNTADMIN role) or a role with the global CREATE INTEGRATION privilege can run this command. Set external_oauth_issuer to the issuer URL from the previous step. The value is case-sensitive and must match exactly, including the trailing slash. For example:
   

   create security integration my_azure_integration
       type = external_oauth
       enabled = true
       external_oauth_type = azure
       external_oauth_issuer = 'https://sts.windows.net/your-tenant-id/'
       external_oauth_token_user_mapping_claim = 'upn'
       external_oauth_snowflake_user_mapping_attribute = 'login_name';

After you create the security integration, set InitiateOAuth to GETANDREFRESH and connect. The following is an example connection string for the OAuthAzureAD authorization code grant:

AuthScheme=OAuthAzureAD;Url=https://myaccount.region.snowflakecomputing.com;InitiateOAuth=GETANDREFRESH;OAuthClientId=MyClientId;OAuthClientSecret=MyClientSecret;AzureTenant=MyTenantId;

The following is an example connection string for the OAuthClientAzureAD client credentials grant:

AuthScheme=OAuthClientAzureAD;Url=https://myaccount.region.snowflakecomputing.com;InitiateOAuth=GETANDREFRESH;OAuthClientId=MyClientId;OAuthClientSecret=MyClientSecret;AzureTenant=MyTenantId;

Desktop Apps

This section describes desktop authentication using the credentials for your custom OAuth app. See Creating a Custom OAuth App for more information.

Get an OAuth Access Token

After setting the following, you are ready to connect:

• OAuthClientId: Set to the Client ID in your OAuth Integration settings.
• OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.
• CallbackURL: Set to the Redirect URL in your OAuth Integration settings.
• InitiateOAuth: Set to GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

When you connect, the connector opens the OAuth endpoint in your default browser. Log in and grant permissions to the application. The connector then completes the following OAuth process:

1. Extracts the access token from the callback URL and authenticates requests.
2. Obtains a new access token when the old one expires.
3. Saves OAuth values in OAuthSettingsLocation to be persisted across connections.

Manually Get an OAuth Access Token

Set the following connection properties to obtain the OAuthAccessToken:

• InitiateOAuth: Set to OFF.
• OAuthClientId: Set to the Client ID in your OAuth Integration settings.
• OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.

You can then call stored procedures to complete the OAuth exchange:

1. Call the GetOAuthAuthorizationUrl stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. The stored procedure returns the URL to the OAuth endpoint and the PKCEVerifier.
2. Open the URL, log in, and authorize the application. You are redirected back to the callback URL.
3. Call the GetOAuthAccessToken stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. Set the PKCEVerifier input to the value of the PKCEVerifier retrieved from the first step.

Headless Machines

To configure the driver to use OAuth with a user account on a headless machine, you need to authenticate on another device that has an internet browser.

1. Choose one of these two options:
   • Option 1: Obtain the OAuthVerifier value as described in "Obtain and Exchange a Verifier Code" below.
   • Option 2: Install the connector on another machine and transfer the OAuth authentication values after you authenticate through the usual browser-based flow, as described in "Transfer OAuth Settings" below.

2. Then configure the connector to automatically refresh the access token from the headless machine.

Option 1: Obtain and Exchange a Verifier Code

To obtain a verifier code, you must authenticate at the OAuth authorization URL.

See Creating a Custom OAuth App for a procedure. This section describes the procedure to authenticate and connect to data.

To obtain the verifier code, set the following properties on the headless machine:

• InitiateOAuth: Set to OFF.
• OAuthClientId: Set to the Client ID in your OAuth Integration settings.
• OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.

Next, authenticate from another machine and obtain the OAuthVerifier connection property:

1. Call the GetOAuthAuthorizationUrl stored procedure. Set the CallbackURL input to the Redirect URI you specified in your app settings. The stored procedure returns the URL to the OAuth endpoint and the PKCEVerifier.
2. Open the returned URL in a browser. Log in and grant permissions to the connector. You are then redirected to the callback URL, which contains the verifier code.
3. Save the value of the Verifier and the value of the PKCEVerifier. You need to set the value of the Verifier in the OAuthVerifier connection property and set the value of the PKCEVerifier in the PKCEVerifier connection property.

Finally, on the headless machine, set the following connection properties to obtain the OAuth authentication values:

• OAuthClientId: Set to the Client ID in your OAuth Integration settings.
• OAuthClientSecret: Set to the Client Secret in your OAuth Integration settings.
• OAuthVerifier: Set to the verifier code.
• PKCEVerifier: Set to the PKCE verifier code.
• OAuthSettingsLocation: Set to persist the encrypted OAuth authentication values to the specified location.
• InitiateOAuth: Set to REFRESH.

Connect to Data

After the OAuth settings file is generated, set the following properties to connect to data:

• OAuthSettingsLocation: Set to the location containing the encrypted OAuth authentication values. Make sure this location gives read and write permissions to the provider to enable the automatic refreshing of the access token.
• InitiateOAuth: Set to REFRESH.

Option 2: Transfer OAuth Settings

To install the connector on another machine, authenticate, and then transfer the resulting OAuth values:

1. On a second machine, install the connector and connect with the following properties set:
   • OAuthSettingsLocation: Set to a writable location.
   • InitiateOAuth: Set to GETANDREFRESH.
   • OAuthClientId: Set to the Client ID in your app settings.
   • OAuthClientSecret: Set to the Client Secret in your app settings.
   • CallbackURL: Set to the Callback URL in your app settings.
2. Test the connection to authenticate. The resulting authentication values are written, encrypted, to the location specified by OAuthSettingsLocation. Once you have successfully tested the connection, copy the OAuth settings file to your headless machine. On the headless machine, set the following connection properties to connect to data:
   • InitiateOAuth: Set to REFRESH.
   • OAuthSettingsLocation: Set to the location of your OAuth settings file. Make sure this location gives read and write permissions to the connector to enable the automatic refreshing of the access token.

Passwords

Set User and Password to a Snowflake user and set AuthScheme to PASSWORD.

Note: Starting with accounts created using Snowflake's bundle 2024_08 (October 2024), password-based authentication is no longer supported due to security concerns. Instead, use alternative authentication methods such as OAuth or Private Key authentication.

Private Key

The connector allows you to authenticate using key pair authentication by creating a secure token with the private key defined for your user account. To connect with this method, set AuthScheme to PrivateKey and set the following values:

• User: The user account to authenticate as.
• PrivateKey: The private key used for the user such as the path to the .pem file containing the private key.
• PrivateKeyType: The type of key store containing the private key such as PEMKEY_FILE, PFXFILE, etc.
• PrivateKeyPassword: The password for the specified private key.

Okta

Set the AuthScheme to OKTA. The following connection properties are used to connect to Okta:

• User: Set this to the Okta user.
• Password: Set this to the Okta password for the user.
• MFAPasscode (optional): Set this to the OTP code that was sent to your device. This property should be used only when the MFA is required for OKTA sign on.

The following SSOProperties are needed to authenticate to Okta:

• Domain: Set this to the OKTA org domain name.
• MFAType (optional): Set this to the multi-factor type. This property should be used only when the MFA is required for OKTA sign on. This property accepts one of the following values:
  • OKTAVerify
  • Email
  • SMS
• APIToken (optional): Set this to the API Token that the customer created from the Okta organization. You should specify this when authenticating a user via a trusted application or proxy that overrides OKTA client request context. In most contexts, it is not needed.

The following is an example connection string:

AuthScheme=OKTA;User=username;Password=password;Url='https://myaccount.region.snowflakecomputing.com';Warehouse=My_warehouse;SSO Properties='Domain=https://cdata-okta.okta.com';

The following is an example connection string for OKTA MFA:

AuthScheme=OKTA;User=username;Password=password;MFAPasscode=8111461;Url='https://myaccount.region.snowflakecomputing.com';Warehouse=My_warehouse;SSO Properties='Domain=https://cdata-okta.okta.com;MFAType=OktaVerify;';

PingFederate

Set the AuthScheme to PingFederate. Set the following connection properties to connect to PingFederate:

• User: Set this to your PingFederate user. You must also add the user to PingFederate Data Stores. When connecting, your browser opens allowing you to login to PingFederate to complete the authentication.
• Password: Set this to the user password.
• ProofKey (optional): You must specify this if you want to connect without using a browser. In a browser setting, this value is autogenerated.
• ExternalToken (optional): Required if you want to connect without a browser. In a browser setting, this value is autogenerated.

The following is an example connection string for PingFederate (assuming that Active Directory is used as a Data Store):

AuthScheme=PingFederate;Url=https://myaccount.region.snowflakecomputing.com;User=myuser@mydomain;Account=myaccount;Warehouse=mywarehouse;

Using a Proof Key and External Token

Setting the AuthScheme to PingFederate involves the use of a Proof Key and an External Token. If you choose to complete authentication via an internet browser, these values are autogenerated and automatically included in the connection string that you use during the Snowflake log in process.

If you choose to connect by means other than via a browser, you must specify values for ProofKey and ExternalToken. In this case, follow the steps below to authenticate:

1. Create a local web server with a specified port, such as 8080.
2. Call the GetSSOAuthorizationURL stored procedure using your specified port. This procedure returns a login SSO URL.
3. Copy and paste the returned URL into a browser.
4. In the page that opens, enter your username and password.
5. After you log in, a callback URL is generated and sent to your local web server instance. This callback URL is in a specialized format. You need to write your own code to extract the External Token from the callback URL.

SAML Providers

The connector has generic support for SAML-based identity providers, such as OneLogin.

Set the AuthScheme to ExternalBrowser.

OneLogin

Set User to the Snowflake user you want to authenticate.

When you attempt a connection, the SAML provider launches a login prompt in your default web browser.

Provide the credentials associated with your SAML provider to authenticate to Snowflake.

Configuring Access Control

If the authenticating user maps to a system-defined role, specify it in the RoleName property.

Java Native Interface (JNI) is a standard programming interface for writing Java native methods and embedding the Java virtual machine into native applications.

The connector leverages the JNI for improved performance on Mac and Linux.

Configure the Config INI File

The Linux and Mac editions of the Snowflake python connector are configured with an ini file. This file is used to set several parameters, including JNI behavior. This file is to be located in:

{path_to_distribution_site-packages}/cdata/config.ini

Ensure that any configuration properties you set in the ini file fall under the following section name (adjust the 311 number if you are using an different python version from 3.11):

• For Linux:
  

  [snowflake.cpython-311-x86_64-linux-gnu.so]

• For Mac:
  

  [snowflake.cpython-311-darwin.so]

Configure the JNI connector's behavior by editing the properties in the connector's config.ini file. The connector can be configured as follows:

• LOGFILE: Set this the same way as the CDATA_LOGFILE envrionment variable below.
• JAVA_HOME: Configure the path to the JVM library location used to launch the JVM.
• CLASS_PATH: Use a colon-separated list to configure the paths to the third-party jar libraries.

Configure Environment Variables

Additionally, set the following environment variables:

• CDATA_JAVA_HOME: Configure the path to the JVM library location used to launch the JVM.
• CDATA_JVM_OPTIONS: Place JVM options here.
• CDATA_LOGFILE: Set this in the following scheme: <SCHEME>://<TAG>[|<LEVEL>]
  • SCHEME: The options are STDOUT, FILE.
    • STDOUT: Both the native wrapper and odbc core log into stdout. The Logfile and Verbosity properties can override the behavior of ODBC core.
    • FILE: The native wrapper logs into <FILENAME> while the odbc core logs into <FILENAME>.driver.log. The Logfile and Verbosity properties can override the behavior of ODBC core.
  • TAG
    • For STDOUT, set this to 1. For FILE, set this to the filename.
  • LEVEL
    • Set to one of: FATAL | ERROR | WARNING | INFO | DEBUG

The following are some examples of this syntax:

• STDOUT://1|DEBUG
• FILE:///tmp/my_py.log|DEBUG

Custom Logger

The Python connector supports a custom logging mechanism for redirecting log output to any destination, such as a cloud storage service or logging framework. Use setCustomLoggerFactory() to register a factory function that creates a logger instance for each connection.

The factory function receives the context string from the Logfile connection property (the portion after CUSTOM://) and must return an object with a writeLog(verbosity, message) method.

To enable custom logging:

1. Call setCustomLoggerFactory() with your factory function before opening connections.
2. Set Logfile to CUSTOM:// followed by a context string to identify the connection.
3. Set Verbosity to the desired log level.

The following example demonstrates a custom logger factory that creates a separate logger instance per connection:

import cdata.snowflake as mod
import time

class MyLogger:
    def __init__(self, loggerId):
        self.loggerId = loggerId
    def writeLog(self, verbosity, message):
        print("[MyLogger " + self.loggerId + "] " + message)

def createLogger(context):
    return MyLogger(context[len("MyLoggerId="):])

mod.setCustomLoggerFactory(createLogger)

conn1 = mod.connect("...;Logfile=CUSTOM://MyLoggerId=1;Verbosity=2;")
# do something with conn1
time.sleep(1)  # Wait for logs to flush from conn1

conn2 = mod.connect("...;Logfile=CUSTOM://MyLoggerId=2;Verbosity=2;")
# do something with conn2
time.sleep(1)  # Wait for logs to flush from conn2

If you do not have access to the user name and password or do not wish to require them, you can use OAuth authentication. Snowflake uses the OAuth, which requires the authenticating user to interact with Snowflake via the browser. The connector facilitates the OAuth exchange in various ways, as described in this section.

Note: This page describes creating a Snowflake-native OAuth integration (a security integration of type = oauth), where Snowflake issues the access tokens. This is used with AuthScheme=OAuth. If you instead want to authenticate through Microsoft Entra ID as an external Identity Provider (AuthScheme=OAuthAzureAD or AuthScheme=OAuthClientAzureAD), Snowflake validates tokens issued by Entra ID rather than issuing them. For that setup, see the External OAuth steps in Establishing a Connection.

Create an OAuth Integration

To register your client, create an integration. An integration is a Snowflake object that provides an interface between Snowflake and third-party services, such as a client that supports OAuth.

Note: Only account administrators (users with the ACCOUNTADMIN role) or a role with the global CREATE INTEGRATION privilege can execute this SQL command.

Create an integration using the CREATE SECURITY INTEGRATION command. For example:

create security integration MYINT
  type = oauth
  enabled = true
  oauth_client = custom
  oauth_client_type = 'CONFIDENTIAL'
  oauth_redirect_uri = 'http://localhost:33333'
  oauth_issue_refresh_tokens = true
  oauth_refresh_token_validity = 86400
  oauth_allow_non_tls_redirect_uri = true
  oauth_client_rsa_public_key ='
  MIIBI
  ..
  ';

After successfully creating the integration object, you can retrieve the Client_ID and Client_Secret using the following command:

select system$show_oauth_client_secrets('MYINT');

General Changes

Date	Version	Source	Category	Type	Description
2026-05-27	26.0.9643	General	Connection	Removed	Removed the deprecated ReplaceInvalidTypesWithNull connection property. Use the ReplaceInvalidValuesWithNull property instead.
2026-05-22	26.0.9638	Python		Removed	Remove support for Intel x64 architecture on macOS
2026-05-19	26.0.9635	Snowflake	Connection	Removed	Removed the AzureAD option from the AuthScheme property.
2026-05-18	26.0.9634	Snowflake	Connection	Added	Added the ExternalStageGCPAccessToken connection property.
2026-05-14	26.0.9630	Snowflake	Query Exec	Added	Added support for external stages in PUT statements, including two new CData options: ExternalStageEncryptionType and ExternalStageMasterKey.
2026-05-10	26.0.9626	Snowflake	Connection	Added	Added the ExternalStageEncryptionType and ExternalStageMasterKey connection properties.
2026-05-07	26.0.9623	General	Data Model	Added	Added the ColumnCapabilities column to the sys_tablecolumns system table. This column is a bit mask denoting the column's write capabilities.
2026-05-07	26.0.9623	Python		Changed	Updated embedded JRE to jre-17.0.19+10 (Linux x64 / MacOs x64).
2026-05-07	26.0.9623	Snowflake	Connection	Changed	In the AuthScheme connection property, renamed the "SAMLAzureAD" option to "EntraSSO".
2026-04-30	26.0.9616	Snowflake	Connection	Changed	Renamed the AzureAD option to SAMLAzureAD in the AuthScheme property.
2026-04-15	26.0.9601	General	Query Exec	Changed	String comparisons using GREATER, LESS, and CONTAINS operators are now case-insensitive by default.
2026-04-03	26.0.9589	Snowflake	Connection	Removed	Removed the OAuthClient option from the AuthScheme property.
2026-04-02	26.0.9588	Snowflake	Connection	Removed	The following properties have been removed: AutoCache CacheConnection CacheDriver CacheLocation CacheMetadata CacheProvider CacheSchema CacheTolerance Offline
2026-03-12	25.0.9567	Snowflake	Connection	Added	Added a new AuthScheme option, ProgrammaticAccessToken, to support authentication via Snowflake Programmatic Access Tokens.
2026-01-13	25.0.9509	General		Added	Added support for the REGEXP_REPLACE() string function.
2025-12-21	25.0.9486	Python		Added	Added support for custom loggers in Python connectors on Linux and macOS.
2025-12-05	25.0.9470	General		Added	Added support for the INSERT INTO SELECT statement, with driver-side execution for providers that do not support the operation natively.
2025-12-02	25.0.9467	Snowflake		Changed	Changed the maximum size of Binary type data fields to 64MB. Changed the maximum size of String type data fields to 128 MB.
2025-10-30	25.0.9434	Python		Changed	Updated embedded JRE to jre-17.0.17+10 (Linux x64 / MacOs x64).
2025-10-06	25.0.9410	General		Added	Support for parsing datetime formats using ".S" and ",S" for milliseconds and nanoseconds.
2025-09-12	25.0.9386	General		Added	Added the IsInsertable, IsUpdateable, and IsDeleteable columns to the sys_tables table.
2025-09-12	25.0.9386	Snowflake		Deprecated	Deprecated the OAuthClient option in the AuthScheme property.
2025-09-10	25.0.9384	General		Changed	All columns in statically defined Views are now reported as read-only.
2025-09-03	25.0.9377	General		Changed	Corrected the behavior when IN criteria with NULL values are used in the projection part. It now returns NULL instead of 0. For example, "NULL IN (1,2)" returns "NULL".
2025-09-01	25.0.9375	General		Added	Added support for using the CAST function with infinity values. This function can cast "inf" and "-inf" to DOUBLE, FLOAT, or REAL.
2025-08-21	25.0.9364	General		Changed	Report behavior change: Fixed inconsistent string value comparisons in non-table queries. For example, "SELECT 'A' = 'a'" previously returned false, but it now returns true.
2025-08-13	25.0.9356	General		Changed	Changed the maximum number of pages held in memory from 15 to 5 for the page providers to decrease heap usage.
2025-08-11	25.0.9354	Snowflake		Added	Added the OAuthJWT option to the AuthScheme property.
2025-08-04	25.0.9347	Snowflake		Added	Added the ClientTimestampNTZTimezone connection property.
2025-07-07	25.0.9319	Python		Removed	Removed the 32-bit version of Windows Python.
2025-07-02	25.0.9314	Python		Removed	Removed support for Python 3.9.
2025-06-25	25.0.9307	General		Removed	Removed the "ADLS Gen 1" value from the ConnectionType property.
2025-06-25	25.0.9307	Python		Added	Added support for Python 3.13 in Windows, Linux, and Mac editions.
2025-06-25	25.0.9307	Python		Removed	Removed support for Python 3.8 as it is no longer supported.
2025-06-20	25.0.9302	General		Added	Created the following functions: TEXT_ENCODE: encodes a string into a different charset (UTF8 → UTF7 and returns a binary array as the result). TEXT_DECODE: takes a binary array and decodes it back into a string when provided the charset. BASE64_ENCODE: takes a binary array and encodes it as a base64 string (varchar). BASE64_DECODE: takes a base 64-encoded string and decodes it into a binary array.
2025-06-18	25.0.9300	General		Changed	The internal code for exception handling has been refactored. Exception messages returned during certain error conditions may now have different wording or formatting.
2025-05-30	25.0.9281	Snowflake		Replaced	Replaced the RetryOnS3Timeout connection property with the RetryOnChunkTimeout property.
2025-05-30	25.0.9281	Snowflake		Removed	Removed the OAuthAuthenticator connection property.
2025-05-30	25.0.9281	Snowflake		Added	Added the following AuthScheme options: OAuthAzureAD, OAuthClientAzureAD, OAuthOKTA, OAuthClientOKTA, OAuthOther, OAuthClientOther.
2025-05-29	25.0.9280	Snowflake		Removed	Removed the following connection properties: PageSize, PageBufferSize, and ReplaceInvalidUTF8Chars.
2025-05-27	25.0.9278	General		Removed	Removed the "Proprietary" enum option from ProxyAuthscheme.
2025-05-12	25.0.9263	Python		Changed	Updated embedded JRE to jre-17.0.15+6 (Linux x64 / MacOS x64) and jre-17.0.15+6 (MacOS aarch64).
2025-03-20	25.0.9210	Snowflake		Added	Added support for the session parameters CLIENT_METADATA_REQUEST_USE_CONNECTION_CTX and CLIENT_METADATA_USE_SESSION_DATABASE in the SessionParameters connection property.
2025-02-15	24.0.9177	General		Added	Added support for converting unsigned integer types to the nearest signed data type that has enough precision to hold the unsigned value.This is done for JDBC only because it does not have support for unsigned data types.
2024-11-27	24.0.9097	General		Added	Added ThreadId to LogModule output. Logfile lines now include the Thread ID associated with the action being performed.
2024-09-23	24.0.9032	Snowflake		Added	Added support for External OAuth by including the OAuthClient authentication option in the AuthScheme connection property and the Other option in the OAuthAuthenticator connection property.
2024-07-03	24.0.8950	Snowflake		Added	Added a new property "BindingType" with two enumeration values: "Default" and "Text". Default uses epoch(nano) encoding for Date, Time, and Timestamp types. Text uses string formatting for Date, Time, and Timestamp types according to the session parameters. This ensures consistent behavior between batch (upload API) and non-batch (binding API) processing for Timestamp types.
2024-06-05	24.0.8922	Python		Added	Added support for Python 3.12.
2024-05-17	24.0.8903	Snowflake		Added	Added new "S3Domain" connection property to allow users to manually set the S3 domain of their Snowflake stage, which is useful when you need to set unique region-specific domains.
2024-05-17	24.0.8903	Snowflake		Removed	Removed support for the SnowflakeJSONResultSet format.
2024-05-09	24.0.8895	General		Changed	The ROUND function previously did not accept negative precision values. That feature has now been restored.
2024-03-18	23.0.8843	Snowflake		Added	Added support for AuthScheme AzureMSI.
2024-03-15	23.0.8840	General		Added	Created a new SQL function called STRING_COMPARE that provides java's String.compare() ability to SQL queries. Returns a number representative of the compared value of two strings
2024-03-01	23.0.8826	Snowflake		Added	Added support for the multiple statement.
2023-11-29	23.0.8733	General		Changed	The ROUND function doesn't accept the negative precision values anymore.
2023-11-29	23.0.8733	General		Changed	The returning types of the FDMonth, FDQuarter, FDWeek, LDMonth, LDQuarter, LDWeek functions are changed from Timestamp to Date. The return type of the ABS function will be consistent with the parameter value type.
2023-11-28	23.0.8732	General		Added	Added the HMACSHA256 formatter to allow for secrets to be decoded if it is in base64 format
2023-10-18	23.0.8691	Snowflake		Added	Added a new property "PrivateKeySubject" to specify the subject of the certificate containing the private key to use with key pair authentication.
2023-10-10	23.0.8683	Snowflake		Added	Added a new connection property "BatchMode" to allow users to manually specify the batch mode.
2023-09-26	23.0.8669	Snowflake		Removed	Removed the "EnableArrow" connection property.
2023-09-20	23.0.8663	Snowflake		Changed	Decimal(2,0) types will be reported as SMALLINT rather than TINYINT by default
2023-08-29	23.0.8641	Python		Added	Added support for SQLAlchemy 2.0.
2023-05-19	23.0.8539	Python		Added	Added support for Python 3.11 on Windows, Linux and Mac.
2023-05-16	23.0.8536	Python		Removed	Removed support for Python 3.7 on Windows and Linux
2023-04-25	23.0.8515	General		Removed	Removed support for the SELECT INTO CSV statement. The core code doesn't support it anymore.
2023-03-18	22.0.8477	Snowflake		Added	Added a new Authscheme "ExternalBrowser" to use the OneLogin SSO identity provider. And the connection property "user" is necessary for this AuthScheme.
2022-11-15	22.0.8354	Python		Changed	Updated embedded JRE to jre8u345-b01(Linux x64 / MacOS x64) and jre-17.0.5+8(MacOS aarch64).
2022-06-29	22.0.8215	Snowflake		Changed	Switched to using the LOCAL TEMPORARY table to support the MERGE statement. This saves costs against the Snowflake server.
2022-05-18	22.0.8173	Python		Added	Added support for Python 3.10 on Windows, Linux, and Mac Added support for Python 3.9 on Mac Added support for Mac M1
2022-05-18	22.0.8173	Python		Removed	Removed support for Python 3.6 on Windows and Linux
2022-03-31	21.0.8125	Snowflake		Added	Added support for using the GET and PUT commands in the SQL statement. This can be used to upload/download files for Azure/S3/GCP.
2021-12-19	21.0.8023	Snowflake		Added	Added support for TVF (table-valued function).
2021-09-02	21.0.7915	General		Added	Added support for the STRING_SPLIT table-valued function in the CROSS APPLY clause.
2021-07-23	21.0.7874	General		Changed	Updated the Literal Function Names for relative date/datetime functions. Previously, relative date/datetime functions resolved to a different value when used in the projection as opposed to the predicate. For example: SELECT LAST_MONTH() AS lm, Col FROM Table WHERE Col > LAST_MONTH(). Formerly, the two LAST_MONTH() methods would resolve to different datetimes. Now, they will match. As a replacement for the previous behavior, the relative date/datetime functions in the criteria may have an 'L' appended to them. For example: WHERE col > L_LAST_MONTH(). This will continue to resolve to the same values that were previously calculated in the criteria. Note that the "L_" prefix will only work in the predicate - it not available for the projection.
2021-07-14	21.0.7865	Snowflake		Changed	Updated the protocol version to 3.13.5, synced with the latest official JDBC driver.
2021-07-12	21.0.7863	Snowflake		Added	Added support for prepared queries via the new connection property, AllowPreparedStatement. Set this property to true to support prepared queries.
2021-04-25	21.0.7785	General		Added	Added support for handling client side formulas during insert / update. For example: UPDATE Table SET Col1 = CONCAT(Col1, " - ", Col2) WHERE Col2 LIKE 'A%'
2021-04-23	21.0.7783	General		Changed	Updated how display sizes are determined for varchar primary key and foreign key columns so they will match the reported length of the column.
2021-04-16	21.0.7776	General		Added	Non-conditional updates between two columns is now available to all drivers. For example: UPDATE Table SET Col1=Col2
2021-04-16	21.0.7776	General		Changed	Reduced the length to 255 for varchar primary key and foreign key columns.
2021-04-16	21.0.7776	General		Changed	Updated index naming convention to avoid duplicates.
2021-04-12	21.0.7772	Snowflake		Deprecated	Deprecated OKTAMfaProvider. The property is not useful as we only support OKTA providers currently.
2021-03-19	21.0.7748	Snowflake		Added	Added support for Google Cloud Platform for Snowflake.
2021-03-19	21.0.7748	Snowflake		Deprecated	Deprecated SSOIdp and SSOIdpDomain. SSOIdp is taken from the AuthScheme now. SSOIdpDomain is replaced with the Domain, which may be passed in via the SSOProperties.
2021-03-16	21.0.7745	Snowflake		Changed	Changed to use PKCE as default for OAuth flow.

This section provides a walk-through for writing Snowflake data access code in Python script.

For more information on the available data source entities and how to query them with SQL, see Data Model.

Connecting from Code

For information on how to deploy the connector and configure the connection to Snowflake, see Package Installation and Establishing a Connection.

For information on how to connect with the snowflake.connector module and its related classes, see Connecting.

Executing SQL

The connection's cursor object is used to directly execute SQL queries. For information on how to execute SELECT statements and process the returned result sets, see Querying Data. For information on to modify the data in Snowflake with INSERT, UPDATE, and DELETE statements, see Modifying Data .

Executing Stored Procedures

You can call stored procedures by using the EXECUTE statement. For further information, see Calling Stored Procedures.

Batch Processing

For information about how to modify several rows of Snowflake data at once using parameterized INSERT, UPDATE, and DELETE statements, see Batch Processing.

Connecting with the cdata.snowflake Module:

The connector's module is used directly to establish a connection with the data source. It does this by using a connection string as its argument. For example:

import cdata.snowflake as mod
conn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

Once the connection is created, you can use it to execute subsequent SQL queries.

After connecting as described in Connecting, you can use the open connection to execute SQL statements.

Executing Queries

To execute SQL statements that return data, use the execute() method. Once a query is executed, the result set is fetched from the cursor. This result set can then be iterated over to process the records individually.

For example:

cur = conn.execute("SELECT Id, ProductName FROM [DemoDB].[PUBLIC].Products")
rs = cur.fetchall()
for row in rs:
	print(row)

Parameterized Queries

Various Python collections, such as arrays and tuples, can act as additional arguments for the execute() method. This enables you to parameterize the queries executed and help to prevent SQL Injection.

For example:

cmd = "SELECT Id, ProductName FROM [DemoDB].[PUBLIC].Products WHERE ProductName = ?"
params = ["Konbu"]
cur = conn.execute(cmd, params)
rs = cur.fetchall()
for row in rs:
	print(row)

The connection is also used to issue INSERT, UPDATE, and DELETE commands to the data source. Parameters can be used with these statements if desired.

Note that the connector does not support transactions. As with normal write operations, all SQL statements executed by this connector affect the data source immediately. Call the connection's commit() method following the execution.

Insert

The following example adds a new record to the table:

cmd = "INSERT INTO [DemoDB].[PUBLIC].Products (Id, ProductName) VALUES (?, ?)"
params = ["Ikura", "Konbu"]
cur = conn.execute(cmd, params)
print("Records affected: ", cur.rowcount)

Update

The following example modifies an existing record in the table:

cmd = "UPDATE [DemoDB].[PUBLIC].Products SET ProductName = ? WHERE Id = ?"
params = ["Konbu", "22"]
cur = conn.execute(cmd, params)
print("Records affected: ", cur.rowcount)

Delete

The following example removes an existing record from the table:

cmd = "DELETE FROM [DemoDB].[PUBLIC].Products WHERE Id = ?"
params = ["22"]
cur = conn.execute(cmd, params)
print("Records affected: ", cur.rowcount)

You can execute stored procedures using either the execute() or callproc() method of the connection.

Calling Stored Procedures Using Execute()

When you call stored procedures by issuing EXECUTE commands, the stored procedure arguments are parameterized. For example:

cmd = "EXECUTE SearchSuppliers Country = ?"
params = ["US"]
conn.execute(cmd, params)

Calling Stored Procedures Using Callproc()

When you call stored procedured by issuing the callproc() method, the stored procedure arguments are a procedure name and a list of parameters. For example:

cur = conn.cursor()
params = ["US"]
cur.callproc("SearchSuppliers", params)

This Python connector also supports writing to the data source via batch processing, using the cursor object's executemany() method. This requires both a SQL statement string and a data frame of values that act as a series of parameters for executing the SQL statement.

Note that the connector does not support transactions. As with normal write operations, all SQL statements executed by this connector affect the data source immediately. Call the connection's commit() method following the execution.

Insert

The following example adds new records to the table:

cur = conn.cursor()
cmd = "INSERT INTO [DemoDB].[PUBLIC].Products (Id, ProductName) VALUES (?, ?)"
params = [["Ikura", "Konbu"], ["Ikura", "Konbu"]]
cur.executemany(cmd, params)
print("Records affected: ", cur.rowcount)

Update

The following example modifies existing records in the table:

cur = conn.cursor()
cmd = "UPDATE [DemoDB].[PUBLIC].Products SET ProductName = ? WHERE Id = ?"
params = [["Konbu", "22"], ["Konbu", "22"]]
cur.executemany(cmd, params)
print("Records affected: ", cur.rowcount)

Delete

The following example removes existing records from the table:

cur = conn.cursor()
cmd = "DELETE FROM [DemoDB].[PUBLIC].Products WHERE Id = ?"
params = [["22"], ["22"]]
cur.executemany(cmd, params)
print("Records affected: ", cur.rowcount)

The connector is integrated with other tools and packages within Python.

Python Integration Guides

The following sections show how to create and use connections with the connector in common packages in Python:

• From SQLAlchemy
• From Pandas
• From Matplotlib
• From Petl

Complete List of Snowflake Integration Quickstarts

For information on connecting from other applications, see Snowflake integration guides.

The CData Python Connector for Snowflake includes a Dialect class that enables integration with SQLAlchemy. Bear in mind that several aspects of connector functionality are not currently supported in SQLAlchemy 2.0 or above. If necessary, downgrade SQLAlchemy to version 1.4 or 1.3 before using this connector.

The following sections detail various aspects of this integration:

Connecting From SQLAlchemy

To construct a URL with which SQLAlchemy loads and uses the appropriate connector automatically, see Connecting

Reflecting Metadata With SQLAlchemy

To learn how to model Snowflake tables with mapped classes, see Reflecting Metadata.

Querying Data From SQLAlchemy

To learn how to use mapped classes to query the associated tables, see Querying Data.

Modifying Data From SQLAlchemy

The connector provides INSERT/UPDATE/DELETE functionality in SQLAlchemy. To learn how to call the session's execute() method to affect the data in the data source, see Modifying Data.

Connecting With a Dialect URL

Establishing a connection using SQLAlchemy requires a specific URL format. For this connector, you can create the engine using either of the following URL formats:

Format 1

from sqlalchemy import create_engine
engine = create_engine("cdata_snowflake:///?url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

Format 2

from sqlalchemy import create_engine
engine = create_engine("cdata_snowflake://User:Password@/?url=https://myaccount.region.snowflakecomputing.com;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

For SQLAlchemy 2.0, the dialect name is snowflake_2. To establish a connection, use the following URL format:

from sqlalchemy import create_engine
engine = create_engine("snowflake_2:///?url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

SQLAlchemy can act as an Object-relational Map (ORM). This enables you to treat records of a database table as instantiable records. To leverage this functionality, you must reflect the underlying metadata in one of the following ways.

Note: The following examples employ SQLAlchemy 1.4.

Modeling Data Using a Mapping Class

Use "sqlalchemy.ext.declarative.declarative_base" to declare a mapping class for the table you wish to model in the ORM. A known table in the data model is modeled either partially or completely, as shown in the following example:

from sqlalchemy.ext.declarative import declarative_base
Base = declarative_base()
class [DemoDB].[PUBLIC].Products(Base):
	__tablename__ = "[DemoDB].[PUBLIC].Products"
	Id = Column(String, primary_key=True)
	Id = Column(String)
	ProductName = Column(String)

Automatically Reflecting Metadata

Rather than mapping tables manually, SQLAlchemy can discover the metadata for one or more tables automatically. To accomplish this across the entire data model, use automap_base:

from sqlalchemy import MetaData
from sqlalchemy.ext.automap import automap_base
meta = MetaData()
abase = automap_base(metadata=meta)
abase.prepare(autoload_with=engine)
[DemoDB].[PUBLIC].Products = abase.classes.[DemoDB].[PUBLIC].Products

You can also reflect a single table with an inspector. When reflecting this way, providing a list of specific columns to map is optional:

from sqlalchemy import MetaData, Table
from sqlalchemy import inspect
meta = MetaData()
insp = inspect(engine)
[DemoDB].[PUBLIC].Products_table = Table("[DemoDB].[PUBLIC].Products", meta)
insp.reflect_table([DemoDB].[PUBLIC].Products_table, ["Id","ProductName"])

After you use the steps in Connecting to connect, and use one of the methods in Reflecting Metadata to reflect some of the metadata, you can use a session object to query data.

Querying Data Using the Query Method

If the mapping class has been prepared, use it with a session object to query the data source. After binding the engine to the session, provide the mapping class to the session's query method.

For example:

engine = create_engine("cdata_snowflake:///?url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")
factory = sessionmaker(bind=engine)
session = factory()
for instance in session.query([DemoDB].[PUBLIC].Products).filter_by(ProductName="Konbu"):
	print("Id: ", instance.Id)
	print("Id: ", instance.Id)
	print("ProductName: ", instance.ProductName)
	print("---------")

Querying Data Using the Execute Method

The session object can also run the query with the execute() method alongside the appropriate Table object. Assuming you have an active session, the following is just as viable:

[DemoDB].[PUBLIC].Products_table = [DemoDB].[PUBLIC].Products.metadata.tables["[DemoDB].[PUBLIC].Products"]
for instance in session.execute([DemoDB].[PUBLIC].Products_table.select().where([DemoDB].[PUBLIC].Products_table.c.ProductName == "Konbu")):
	print("Id: ", instance.Id)
	print("FullName: ", instance.Name)
	print("City: ", instance.BillingCity)
	print("---------")

Implicit Joining

If mapped classes of related Snowflake objects have a singular foreign key relationship, the classes are implicitly joined. After importing the necessary objects, a relationship is established between your two mapped classes, as in the example below:

from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy import Column, String, Integer, DateTime, ForeignKey
from sqlalchemy.orm import sessionmaker, relationship

Base = declarative_base()
class Contact(Base):
	__tablename__ = "Contact"
	Id = Column(Integer, primary_key=True)
	Name = Column(String)
	Email = Column(String)
	BirthDate = Column(DateTime)
	AccountId = Column(String, ForeignKey("Account.Id"))
	Account_Link = relationship("Account", back_populates="Contact_Link")

class Account(Base):
	__tablename__ = "Account"
	Id = Column(String, primary_key=True)
	Name = Column(String)
	BillingCity = Column(String)
	NumberOfEmployees = Column(Integer)
	Contact_Link = relationship("Contact", order_by=Contact.Id, back_populates="Account_Link")

Once the relationship is established, the tables are queried simultaneously using the session's query() method. For example:

rs = session.query(Account, Contact).filter(Account.Id == Contact.AccountId)
for Ac, Ct in rs:
  print("AccountId: ", Ac.Id)
  print("AccountName: ", Ac.Name)
  print("ContactId: ", Ct.Id)
  print("ContactName: ", Ct.Name)

Other Join Forms

In situations where mapped classes have either no foreign keys or multiple foreign keys, you may need different forms of the JOIN query to accommodate them. Using the earlier classes as examples, the following JOIN queries are possible as well:

• Explicit condition (necessary if there are no foreign keys in your mapped classes):
  

  rs = session.query(Account, Contact).join(Contact, Account.Id == Contact.AccountId)
  for Ac, Ct in rs:

• Left-to-right relationship:
  

  rs = session.query(Account, Contact).join(Account.Contact_Link)
  for Ac, Ct in rs:

• Left-to-right relationship with explicit target:
  

  rs = session.query(Account, Contact).join(Contact, Account.Contact_Link)
  for Ac, Ct in rs:

• String form of a left-to-right relationship:
  

  rs = session.query(Account, Contact).join("Contact_Link")
  for Ac, Ct in rs:

SQLAlchemy ORM also exposes support for other clauses in SQL, such as ORDER BY, GROUP BY, LIMIT, and OFFSET. All of these are supported by this connector:

ORDER BY

The following example sorts by a specified column using the session object's query() method:

rs = session.query([DemoDB].[PUBLIC].Products).order_by([DemoDB].[PUBLIC].Products.Price)
for instance in rs:
	print("Id: ", instance.Id)
	print("Id: ", instance.Id)
	print("ProductName: ", instance.ProductName)
	print("---------")

You can also use the session object's execute() method perform an ORDER BY. For example:

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().order_by([DemoDB].[PUBLIC].Products_table.c.Price))
for instance in rs:

GROUP BY

The following example uses the session object's query() method to group records with a specified column:

rs = session.query(func.count([DemoDB].[PUBLIC].Products.Id).label("CustomCount"), [DemoDB].[PUBLIC].Products.Id).group_by([DemoDB].[PUBLIC].Products.Id)
for instance in rs:
	print("Count: ", instance.CustomCount)
	print("Id: ", instance.Id)
	print("---------")

You can also use the session object's execute() method to perform a GROUP BY:

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().with_only_columns([func.count([DemoDB].[PUBLIC].Products_table.c.Id).label("CustomCount"), [DemoDB].[PUBLIC].Products_table.c.Id]).group_by([DemoDB].[PUBLIC].Products_table.c.Id))
for instance in rs:

LIMIT and OFFSET

The following example uses the session object's query() method to skip the first 100 records and fetch the following 25:

rs = session.query([DemoDB].[PUBLIC].Products).limit(25).offset(100)
for instance in rs:
	print("Id: ", instance.Id)
	print("Id: ", instance.Id)
	print("ProductName: ", instance.ProductName)
	print("---------")

You can also use the session object's execute() method to set a LIMIT or OFFSET:

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().limit(25).offset(100))
for instance in rs:

Certain aggregate functions can also be used within SQLAlchemy by using the func module.

To import this module, execute:

from sqlalchemy.sql import func

Once func is imported, the following aggregate functions are available:

COUNT

The following example counts the number of records in a set of groups using the session object's query() method.

rs = session.query(func.count([DemoDB].[PUBLIC].Products.Id).label("CustomCount"), [DemoDB].[PUBLIC].Products.Id).group_by([DemoDB].[PUBLIC].Products.Id)
for instance in rs:
	print("Count: ", instance.CustomCount)
	print("Id: ", instance.Id)
	print("---------")

You can also execute COUNT using the session object's execute() method:

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().with_only_columns([func.count([DemoDB].[PUBLIC].Products_table.c.Id).label("CustomCount"), [DemoDB].[PUBLIC].Products_table.c.Id])group_by([DemoDB].[PUBLIC].Products_table.c.Id))
for instance in rs:

SUM

This example calculates the cumulative amount of a numeric column in a set of groups.

rs = session.query(func.sum([DemoDB].[PUBLIC].Products.Price).label("CustomSum"), [DemoDB].[PUBLIC].Products.Id).group_by([DemoDB].[PUBLIC].Products.Id)
for instance in rs:
	print("Sum: ", instance.CustomSum)
	print("Id: ", instance.Id)
	print("---------")

You can also invoke SUM using the session object's execute() method.

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().with_only_columns([func.sum([DemoDB].[PUBLIC].Products_table.c.Price).label("CustomSum"), [DemoDB].[PUBLIC].Products_table.c.Id]).group_by([DemoDB].[PUBLIC].Products_table.c.Id))
for instance in rs:

AVG

This example uses the session object's query() method to calculate the average amount of a numeric column in a set of groups:

rs = session.query(func.avg([DemoDB].[PUBLIC].Products.Price).label("CustomAvg"), [DemoDB].[PUBLIC].Products.Id).group_by([DemoDB].[PUBLIC].Products.Id)
for instance in rs:
	print("Avg: ", instance.CustomAvg)
	print("Id: ", instance.Id)
	print("---------")

You can also use the session object's execute() method to invoke AVG:

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().with_only_columns([func.avg([DemoDB].[PUBLIC].Products_table.c.Price).label("CustomAvg"), [DemoDB].[PUBLIC].Products_table.c.Id]).group_by([DemoDB].[PUBLIC].Products_table.c.Id))
for instance in rs:

MAX and MIN

This example finds the maximum value and minimum value of a numeric column in a set of groups.

rs = session.query(func.max([DemoDB].[PUBLIC].Products.Price).label("CustomMax"), func.min([DemoDB].[PUBLIC].Products.Price).label("CustomMin"), [DemoDB].[PUBLIC].Products.Id).group_by([DemoDB].[PUBLIC].Products.Id)
for instance in rs:
	print("Max: ", instance.CustomMax)
	print("Min: ", instance.CustomMin)
	print("Id: ", instance.Id)
	print("---------")

You can also use the session object's execute() method to invoke MAX and MIN:

rs = session.execute([DemoDB].[PUBLIC].Products_table.select().with_only_columns([func.max([DemoDB].[PUBLIC].Products_table.c.Price).label("CustomMax"), func.min([DemoDB].[PUBLIC].Products_table.c.Price).label("CustomMin"), [DemoDB].[PUBLIC].Products_table.c.Id]).group_by([DemoDB].[PUBLIC].Products_table.c.Id))
for instance in rs:

Commands can be executed individually by the session with a call to "execute()".

Obtaining the Table Object

The query supplied to this method is constructed using the associated Table object of a mapped class. This Table object is obtained from the mapped class's metadata field, as below:

[DemoDB].[PUBLIC].Products_table = [DemoDB].[PUBLIC].Products.metadata.tables["[DemoDB].[PUBLIC].Products"]

Once the table object is obtained, the write operations are executed in the following ways. The queries are executed immediately without the need for a call to "commit()":

Insert

The following example adds a new record to the table:

session.execute([DemoDB].[PUBLIC].Products_table.insert(), {"Id": "Ikura", "ProductName": "Konbu"})

Update

The following example modifies an existing record in the table:

session.execute([DemoDB].[PUBLIC].Products_table.update().where([DemoDB].[PUBLIC].Products_table.c.Id == "22").values(Id="Ikura", ProductName="Konbu"))

Delete

The following example removes an existing record from the table:

session.execute([DemoDB].[PUBLIC].Products_table.delete().where([DemoDB].[PUBLIC].Products_table.c.Id == "22"))

When combined with the connector, Pandas can be used to generate data frames that contain your Snowflake data. Once created, a data frame can be passed to various other Python packages.

Connecting

Pandas relies on an SQLAlchemy engine to execute queries. Before you can use Pandas you must import it:

import pandas as pd
from sqlalchemy import create_engine
engine = create_engine("cdata_snowflake:///?url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

Querying Data

In Pandas, SELECT queries are provided in a call to the read_sql() method, alongside a relevant connection object. Pandas executes the query on that connection, and returns the results in the form of a data frame, which can be used for a variety of purposes.

df = pd.read_sql("""
	SELECT
	   Id,
	   ProductName,
     $exNumericCol;
	FROM [DemoDB].[PUBLIC].Products;""", engine)
print(df)

Modifying Data

To insert new records into a table, create a new data frame, and define its fields accordingly. When that is done, call to_sql() on the data frame to perform the INSERT operation with the connector, as shown in the example below. You must set the "if _exists" argument to "append" to prevent Pandas from attempting building the table from scratch. To prevent Pandas from writing the data frame index as a column, set index=False.

df = pd.DataFrame({"Id": ["Ikura"], "ProductName": ["Konbu"]})
df.to_sql("[DemoDB].[PUBLIC].Products", con=engine, if_exists="append", index=False)

Matplotlib contains a number of tools that can graphically model Snowflake data after being fed a data frame From Pandas.

Using PyPlot

Before any Matplotlib tool, such as pyplot, can be used, it must be imported:

from matplotlib import pyplot as plt

Once a Pandas data frame is obtained, it can be used to create a plot visualizing Snowflake data. For example, the following plot generates and displays a bar graph relating Id and Price values:

df.plot(kind="bar", x="Id", y=["Price"])
plt.show()

The connector can be used to create ETL applications and pipelines for CSV data in Python using Petl.

Install Required Modules

Install the Petl modules using the pip utility.

pip install petl

Connecting

After you import the modules, including the CData Python Connector for Snowflake, you can use the connector's connect function to create a connection using a valid Snowflake connection string. If you prefer not to use a direct connection, you can use a SQLAlchemy engine.

import petl as etl
import cdata.snowflake as mod
cnxn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")

Extract, Transform, and Load the Snowflake Data

Create a SQL query string and store the query results in a DataFrame.

sql = "SELECT	Id, ProductName FROM [DemoDB].[PUBLIC].Products "
table1 = etl.fromdb(cnxn,sql)

Loading Data

With the query results stored in a DataFrame, you can load your data into any supported Petl destination. The following example loads the data into a CSV file.

etl.tocsv(table1,'output.csv')

Modifying Data

Insert new rows into Snowflake tables using Petl's appenddb function.

table1 = [['Id','ProductName'],['Ikura','Konbu']]
etl.appenddb(table1,cnxn,'[DemoDB].[PUBLIC].Products')

The extension supports schema discovery by using SQL queries to available System Tables.

Using SQL

The following sections describe the discovery of metadata through several System Tables:

• Tables and Views
• Columns
• Procedures

The connector possesses system tables that are used to discover the tables and views available in the data model. Of these system tables, "sys_tables" and "sys_views" are used to fetch information about the available tables and views respectively:

Tables

import cdata.snowflake as mod
conn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")
cur = conn.cursor()
cmd = "SELECT * FROM sys_tables"
cur.execute(cmd)
rs = cur.fetchall()
for row in rs:
	print(row)

Views

import cdata.snowflake as mod
conn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")
cur = conn.cursor()
cmd = "SELECT * FROM sys_views"
cur.execute(cmd, params)
rs = cur.fetchall()
for row in rs:
	print(row)

The available columns for any given table are fetched from a system table called "sys_tablecolumns". A specific table name is provided in the WHERE criteria to restrict the table from which the column information is fetched:

import cdata.snowflake as mod
conn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")
cur = conn.cursor()
cmd = "SELECT * FROM sys_tablecolumns WHERE TableName = '[DemoDB].[PUBLIC].Products'"
cur.execute(cmd)
rs = cur.fetchall()
for row in rs:
	print(row)

Procedures

A system table called "sys_procedures" is queried to obtain the available stored procedures that are executed:

import cdata.snowflake as mod
conn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")
cur = conn.cursor()
cmd = "SELECT * FROM sys_procedures"
cur.execute(cmd)
rs = cur.fetchall()
for row in rs:
	print(row)

Parameters

The input parameters of any stored procedure are similarly obtained from the "sys_procedureparameters" system table:

import cdata.snowflake as mod
conn = mod.connect("url=https://myaccount.region.snowflakecomputing.com;user=Admin;password=test123;Database=Northwind;Warehouse=TestWarehouse;Account=Tester1;")
cur = conn.cursor()
cmd = "SELECT * FROM sys_procedureparameters WHERE ProcedureName = 'SearchSuppliers'"
cur.execute(cmd)
rs = cur.fetchall()
for row in rs:
	print(row)

This section details a selection of advanced features of the Snowflake connector.

SSL Configuration

Use SSL Configuration to adjust how connector handles TLS/SSL certificate negotiations. You can choose from various certificate formats;. For further information, see the SSLServerCert property under "Connection String Options" .

Firewall and Proxy

Configure the connector for compliance with Firewall and Proxy, including Windows proxies and HTTP proxies. You can also set up tunnel connections.

Logging

For an overview of configuration settings that can be used to refine CData logging, see Logging. Only two connection properties are required for basic logging, but there are numerous features that support more refined logging, which enables you to use the LogModules connection property to specify subsets of information to be logged.

Exception Handling

For an overview of how exceptions are reported and the components of an exception, see Exception Handling.

Customizing the SSL Configuration

By default, the connector attempts to negotiate TLS with the server. The server certificate is validated against the default system trusted certificate store. You can override how the certificate gets validated using the SSLServerCert connection property.

To specify another certificate, see the SSLServerCert connection property.

Connecting Through a Firewall or Proxy

HTTP Proxies

Note: The connector uses the system proxy settings by default, without further configuration needed. If you want to connect to other proxies, set ProxyAutoDetect to False and read further.

To authenticate to an HTTP proxy, set the following:

• ProxyServer: the hostname or IP address of the proxy server that you want to route HTTP traffic through.
• ProxyPort: the TCP port that the proxy server is running on.
• ProxyAuthScheme: the authentication method the connector uses when authenticating to the proxy server.
• ProxyUser: the username of a user account registered with the proxy server.
• ProxyPassword: the password associated with the ProxyUser.

Other Proxies

Set the following properties:

• To use a proxy-based firewall, set FirewallType, FirewallServer, and FirewallPort.
• To tunnel the connection, set FirewallType to TUNNEL.
• To authenticate, specify FirewallUser and FirewallPassword.
• To authenticate to a SOCKS proxy, additionally set FirewallType to SOCKS5.

Logging

Capturing connector logging can be very helpful when diagnosing error messages or other unexpected behavior.

Basic Logging

To begin capturing connector logging, set these properties:

• Logfile: A filepath that designates the name and location of the log file.
• Verbosity: A numerical value (1-5) that determines the amount of detail in the log. See the page in the Connection Properties section for an explanation of the five levels.
• MaxLogFileSize: When the limit is hit, a new log is created in the same folder with the date and time appended to the end. The default limit is 100 MB. Values lower than 100 kB will use 100 kB as the value instead.
• MaxLogFileCount: A string specifying the maximum file count of log files. When the limit is hit, a new log is created in the same folder with the date and time appended to the end and the oldest log file will be deleted. Minimum supported value is 2. A value of 0 or a negative value indicates no limit on the count.

Once these properties are set, the connector populates the log file as it carries out various tasks, such as when authentication is performed or queries are executed. If the specified file doesn't already exist, it is created.

Log Verbosity

The verbosity level determines the amount of detail that the connector reports to the Logfile. Supported Verbosity levels range from 1 to 5.

The following list describes each level:

1	Setting Verbosity to 1 logs the query, the number of rows returned by it, the start of execution and the time taken, and any errors.
2	Setting Verbosity to 2 logs everything included in Verbosity 1 and additional information about the request.
3	Setting Verbosity to 3 also logs HTTP headers, as well as the body of the request and the response.
4	Setting Verbosity to 4 also logs transport-level communication with the data source. This includes SSL negotiation.
5	Setting Verbosity to 5 also logs communication with the data source and additional details that may be helpful in troubleshooting problems. This includes interface commands.

For normal operations, Verbosity should not be set to greater than 1. At higher verbosities you can log substantial amounts of data, which can delay execution times.

To refine the logged content further by showing/hiding specific categories of information, see LogModules.

Sensitive Data

Verbosity levels of 3 and higher may capture information that you do not want shared outside of your organization. The following lists information of concern for each level:

• Verbosity 3: The full body of the request and the response, which includes all the data returned by the connector
• Verbosity 4: SSL certificates
• Verbosity 5: Any extra transfer data not included at Verbosity 3, such as non human-readable binary transfer data

Note: Although we mask sensitive values, such as passwords, in the connection string and any request in the log, it is always best practice to review the logs for any sensitive information before sharing outside your organization.

Advanced Logging

You may want to refine the exact information that is recorded to the log file. This can be accomplished using the LogModules property. This property allows you to filter the logging using a semicolon-separated list of logging modules.

Example property value:

LogModules=INFO;EXEC;SSL;SQL;META;

Note that the logfile filtering triggered by the Verbosity connection property takes precedence over the filtering imposed by this connection property. This means that operations of a higher verbosity level than the level specified in the Verbosity connection property are not printed in the logfile, even if they belong to one of the modules specified in this connection property.

The available modules and submodules are:

Module Name	Module Description	Submodules
INFO	General Information. Includes the connection string, product version (build number), and initial connection messages.	Connec – Information related to creating or destroying connections. Messag – Generic label for messages pertaining to connections, the connection string, and product version. These messages are typically specific to the connector, rather than being received and passed along directly from the service.
EXEC	Query Execution. Includes execution messages for user-written SQL queries, parsed SQL queries, and normalized SQL queries. Success/failure messages for queries and query pages appear here as well.	Messag – Messages pertaining to query execution. These messages are typically specific to the connector, rather than being received and passed along directly from the service. Normlz – Query normalization steps. Query normalization is when the product takes the user-submitted query and rewrites the query to get the same results with optimal performance. Origin – This label applies to any messages recording a user's original query (the exact, unaltered, non-normalized query executed by the user). Page – Messages related to query paging. Parsed – Query parsing steps. Parsing is the process of converting the user-submitted query into a standardized format for easier processing.
HTTP	HTTP protocol messages. Includes HTTP requests/responses (including POST messages), as well as Kerberos related messages.	KERB – HTTP requests related to Kerberos. Messag – Messages pertaining to HTTP protocols. These messages are typically specific to the connector, rather than being received and passed along directly from the service. Unpack – This label applies to messages about zipped data being returned from the service API and unpacked by the product. Res – Messages containing HTTP responses. Req – Messages containing HTTP requests.
WSDL	Messages pertaining to the generation of WSDL/XSD files.	—
SSL	SSL certificate messages.	Certif – Messages pertaining to SSL certificates.
AUTH	Authentication related failure/success messages.	Messag – Messages pertaining to authentication. These messages are typically specific to the connector, rather than being received and passed along directly from the service. OAuth – Messages related to OAuth authentication. Krbros – Kerberos-related authentication messages.
SQL	Includes SQL transactions, SQL bulk transfer messages, and SQL result set messages.	Bulk – Messages pertaining to bulk query execution. Cache – Messages related to reading row data from and writing row data to the product's cache for better performance. Messag – Messages pertaining to SQL transactions. These messages are typically specific to the connector, rather than being received and passed along directly from the service. ResSet – Query resultsets. Transc – Messages related to handling transactions, including information about the number of jobs executed and backup table handling.
META	Metadata cache and schema messages.	Cache – Messages related to reading from and modifying column and table definitions in the product's cache for better performance. Schema – Messages related to retrieving metadata from or modifying the service schema. MemSto – Messages related to writing to or reading from in-memory metadata cache. Storag – Messages relating to storing metadata on disk or in an external data store, rather than in memory.
FUNC	Information related to executing SQL functions.	Errmsg – Error messages related to executing SQL functions.
TCP	Incoming and outgoing raw bytes on TCP transport layer messages.	Send – Raw data sent via the TCP protocol. Receiv – Raw data received via the TCP protocol.
FTP	Messages pertaining to the File Transfer Protocol.	Info – Status messages related to communication in the FTP protocol. Client – Messages related to actions taken by the FTP client (the product) during FTP communication. Server – Messages related to actions taken by the FTP server during FTP communication.
SFTP	Messages pertaining to the Secure File Transfer Protocol.	Info – Status messages related to communication in the SFTP protocol. To_Server – Messages related to actions taken by the SFTP client (the product) during SFTP communication. From_Server – Messages related to actions taken by the SFTP server during SFTP communication.
POP	Messages pertaining to data transferred via the Post Office Protocol.	Client – Messages related to actions taken by the POP client (the product) during POP communication. Server – Messages related to actions taken by the POP server during POP communication. Status – Status messages related to communication in the POP protocol.
SMTP	Messages pertaining to data transferred via the Simple Mail Transfer Protocol.	Client – Messages related to actions taken by the SMTP client (the product) during SMTP communication. Server – Messages related to actions taken by the SMTP server during SMTP communication. Status – Status messages related to communication in the SMTP protocol.
CORE	Messages relating to various internal product operations not covered by other modules.	—
DEMN	Messages related to SQL remoting.	—
CLJB	Messages about bulk data uploads (cloud job).	Commit – Submissions for bulk data uploads.
SRCE	Miscellaneous messages produced by the product that don't belong in any other module.	—
TRANCE	Advanced messages concerning low-level product operations.	—

Exception Handling

Exceptions can be surfaced from either the API or the CData Python Connector for Snowflake. Each exception will have an error code, an error message, and a SQL state.

Error Codes

The error code classifies the type of error.

0	NONE	Used for unclassified errors and internally handled errors. This code also covers data source-specific errors that do not fit in any specific category.
65537	TCP_UNKNOWN_HOST	Unable to resolve a hostname (DNS failure).
65538	TCP_CONNECTION_REFUSED	Could not connect to the remote port.
65539	TCP_AUTH_FAILED	Login failed when using a binary authentication protocol. Use this for auth errors when the protocol is not HTTP (LDAP, SASL, Kerberos, ...).
65540	TCP_TIMEOUT	Did not receive a response after sending a request to the server.
65541	TCP_PROTOCOL	For wire protocol drivers. Either the server sent a bad packet that we are unable to process, or we cannot construct a packet to send.
131073	TLS_SERVER_UNTRUSTED	Could not verify SSL server certificate.
131074	TLS_CLIENT_UNTRUSTED	Server did not accept the client certificate we sent.
196609	OAUTH_DECRYPT_FAILED	OAuthEncryptKey did not decrypt the OAuthSettings file.
196610	OAUTH_MISSING_CLIENT_INFO	OAuthClientId / OAuthClientSecret / OAuthJWTCert is missing.
196611	OAUTH_MISSING_PROP	General OAuth property missing. OAUTH_MISSING_CLIENT_INFO is used for missing client ID/secret and JWT cert.
196612	OAUTH_NO_ACCESS_TOKEN	Unable to retrieve access token. Only use this when getting a token in GetOAuthAccessToken / RefreshOAuthAccessToken.
196613	OAUTH_TOKEN_EXPIRED	The access token expired. Normally used with a RefreshOAuth/OAuthException behavior.
196614	OAUTH_INVALID_PROP	OAuth property has an invalid value. OAUTH_MISSING_CLIENT_INFO / OAUTH_MISSING_PROP is used if the value is not set.
262145	HTTP_REQUEST_TIMEOUT	Did not receive a response from the HTTP server.
262146	HTTP_CLIENT_ERROR	Generic HTTP 4xx error. Only use for 4xx errors not covered by other codes.
262147	HTTP_AUTH_FAILED	HTTP 401 error.
262148	HTTP_LIMIT_EXCEEDED	HTTP 429 error.
262149	HTTP_SERVER_ERROR	HTTP 5xx error.
262150	HTTP_NOT_FOUND_ERROR	HTTP 404 error.
327681	CORE_TIMEOUT	General timeout. Not related to a specific network request.
327682	CORE_OP_NOT_ALLOWED	Operation blocked by provider permissions.
327683	CORE_CONNECTION_CONFIG	Connection configuration is not valid.
327684	CORE_SERIALIZE	Failed to encode data into a specific format (XML, JSON, CSV, ...).
327685	CORE_DESERIALIZE	Failed to decode data from a specific format (XML, JSON, CSV, ...).
393217	SQL_SYNTAX_ERROR	Unable to parse a SQL query.
393218	SQL_MISSING_COLUMNS	Query did not include required columns.
393219	SQL_MISSING_PARAMS	Stored procedure call did not include required parameters.
393220	SQL_QUERY_NOT_SUPPORTED	A part of the query is not allowed in the current context.
458753	SSH_SERVER_UNTRUSTED	Could not verify SSH server.
524289	STORAGE_LIST_EXCEPTION	Issue listing storage resources.
524290	STORAGE_RESOURCE_NOT_FOUND	Issue finding storage resources.
524291	STORAGE_ROOT_RESOURCE_NOT_FOUND	The root resource (bucket/share/drive) was not found; cannot create it in flat file drivers.
524292	STORAGE_RESOURCE_NOT_A_DIRECTORY	Storage resource is not a directory.
524293	STORAGE_RESOURCE_NOT_A_FILE	Storage resource is not a file.
524294	STORAGE_PERMISSIONS_DENIED	Storage permissions denied.

SQL State

The SQL state is used when throwing generic provider errors to the wrapper and indicates the success or failure of a call.

Some of the common SQL states are listed below:

07007	REQUIRED_CLAUSE	Class Code 07: Dynamic SQL Error.
08001	OPEN_CONNECTION	Class Code 08: Connection Exception. The connection was unable to be established to the application server or other server.
08004	REJECT_CONNECTION	The application server rejected establishment of the connection.
42501	PRIVILEGE_IDENTIFIED_OBJECT	Class Code 42: Syntax Error or Access Rule Violation. The authorization ID does not have the privilege to perform the specified operation on the identified object.
42506	AUTH_FAILED	Owner authorization failure occurred.
42601	SQL_SYNTAX	A character, token, or clause is invalid or missing.

Error Message

The error message provides more detailed reasoning about why the error occurred. It provides an explanation of the issue, and may include steps on how to resolve it.

The connector uses the Snowflake API to enable bidirectional SQL access.

Discovering Schemas

The CData Python Connector for Snowflake automatically retrieves the structure of your data from Snowflake, including warehouses, databases, and schemas. Specifying a database or schema is optional, but doing so limits the available tables and views to only those within the selected database or schema.

Stored Procedures

Stored Procedures are function-like interfaces to Snowflake. They are used for OAuth authentication.

Stored procedures are function-like interfaces that extend the functionality of the connector beyond simple SELECT/INSERT/UPDATE/DELETE operations with Snowflake.

Stored procedures accept a list of parameters, perform their intended function, and then return any relevant response data from Snowflake, along with an indication of whether the procedure succeeded or failed.

CData Python Connector for Snowflake Stored Procedures

Name	Description
GetOAuthAccessToken	Fetches the OAuth Access Token, which is used to authenticate and authorize API calls made to Snowflake.
GetOAuthAuthorizationUrl	Retrieves the OAuth Authorization URL, allowing the client to direct the user's browser to the authorization server and initiate the OAuth process. Only needed when developing Web apps.
GetSSOAuthorizationURL	Retrieves the Single Sign-On (SSO) authorization URL for browser-based authentication in Snowflake. The returned URL must be accessed in a web browser to request an access token for API connections.
RefreshOAuthAccessToken	Refreshes an expired OAuth Access Token to maintain continuous authenticated access to Snowflake resources without requiring reauthorization from the user.

Fetches the OAuth Access Token, which is used to authenticate and authorize API calls made to Snowflake.

Input

Name	Type	Required	Description
AuthMode	String	False	Specifies the authentication mode to use. Allowed values: 'APP' for application-based authentication, 'WEB' for browser-based authentication requiring user interaction.
CallbackUrl	String	False	The URL to which the user is redirected after completing the OAuth authorization process.
Verifier	String	False	A one-time verifier code returned by Snowflake after the user grants authorization. Required only when using 'WEB' authentication mode.
PKCEVerifier	String	False	A code challenge used for Proof Key for Code Exchange (PKCE) validation. Generated and returned by GetOAuthAuthorizationURL.
Prompt	String	False	Determines the type of prompt shown during authentication. Options: 'select_account' prompts the user to choose an account, 'None' disables prompts, 'login' forces a credential entry, and 'consent' displays an OAuth consent dialog for permission approval.

Result Set Columns

Name	Type	Description
OAuthRefreshToken	String	A token that can be used to request a new OAuth access token without requiring the user to reauthenticate.
OAuthAccessToken	String	The OAuth access token required for authenticating API requests to Snowflake.
ExpiresIn	String	Indicates how long the access token remains valid, measured in seconds. A value of -1 means the token does not expire.

Retrieves the OAuth Authorization URL, allowing the client to direct the user's browser to the authorization server and initiate the OAuth process. Only needed when developing Web apps.

Input

Name	Type	Required	Description
CallbackUrl	String	False	The URL to which the user is redirected after completing the OAuth authorization process.
Scope	String	False	Defines the level of access granted to Snowflake. Scope parameters in the authorization request can restrict operations and roles permitted by the access token. The default scope is 'refresh_token'.
State	String	False	An optional value sent with the callback URL to maintain application state or pass additional information during the OAuth flow.
Prompt	String	False	Controls the authentication prompt behavior. Options: 'select_account' prompts the user to choose an account, 'None' disables prompts, 'login' forces a credential entry, and 'consent' displays an OAuth consent dialog requesting permission approval.

Result Set Columns

Name	Type	Description
Url	String	The OAuth authorization URL that the user must visit to grant access to the application.
PKCEVerifier	String	A randomly generated string used as a challenge in the PKCE (Proof Key for Code Exchange) flow. Required when retrieving an access token using GetOAuthAccessToken.

Retrieves the Single Sign-On (SSO) authorization URL for browser-based authentication in Snowflake. The returned URL must be accessed in a web browser to request an access token for API connections.

Input

Name	Type	Required	Description
Port	String	False	Specifies the listening port on the local machine for the callback URL where the authorization response will be received. The default value is 80.

Result Set Columns

Name	Type	Description
ProofKey	String	A cryptographic key used for verifying the integrity of the authentication request in the SSO process.
SSOURL	String	The SSO authorization URL that users must visit to initiate authentication with Snowflake.
TokenURL	String	The URL used to request an access token after successful SSO authentication.

Refreshes an expired OAuth Access Token to maintain continuous authenticated access to Snowflake resources without requiring reauthorization from the user.

Input

Name	Type	Required	Description
OAuthRefreshToken	String	True	The refresh token used to obtain a new OAuth access token after the previous one has expired.

Result Set Columns

Name	Type	Description
OAuthAccessToken	String	A newly generated OAuth access token that can be used for authentication in Snowflake API requests.
OAuthRefreshToken	String	A newly issued refresh token, which may be the same as the access token depending on the OAuth flow.
ExpiresIn	String	The duration (in seconds) for which the new access token remains valid. A value of -1 indicates the token does not expire.

The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider. Click the links for further details.

For more information on establishing a connection, see Establishing a Connection.

Authentication

---

Property	Description
AuthScheme	Specifies the authentication scheme used to establish a connection to Snowflake. It determines the authentication mechanism required for validating the user's identity and allows integration with various SSO and OAuth providers.
Account	The Snowflake account identifier used to connect to a Snowflake instance. The account identifier is usually derived from the URL automatically.
Warehouse	Specifies the name of the Snowflake warehouse to be used for query execution. A warehouse in Snowflake is a virtual compute resource that provides the necessary processing power to perform operations such as data loading, querying, and analytics.
User	Specifies the username used for authenticating with the Snowflake database. The username is required for establishing a successful connection, regardless of the authentication method being used (Password, OKTA, PrivateKey, or OAuth).
Password	Specifies the user's password used for authenticating with Snowflake. This property is required when using password-based authentication methods, including Password, PingFederate, and OKTA.
WorkloadIdentityProvider	Specifies the cloud provider type for Workload Identity Federation authentication with Snowflake. This property is required when AuthScheme is set to WorkloadIdentityFederation.
URL	Set this property to the URL of your Snowflake database instance. This URL is required for establishing a connection to your Snowflake environment and should follow the standard format provided by Snowflake. The URL is typically structured as follows: https://orgname-myaccount.snowflakecomputing.com.
WorkloadIdentityToken	Specifies the OIDC identity token used for Workload Identity Federation authentication with Snowflake. This property is required only when WorkloadIdentityProvider is set to OIDC.
MFAPasscode	Provides a Multi-Factor Authentication (MFA) code when connecting to Snowflake. This code is required when MFA is enabled for your Snowflake account and you are using time-based one-time passwords (TOTP) or push-based authentication methods.
RoleName	Specifies the role assigned to the Snowflake user during authentication. This property determines the access privileges and permissions the user has when executing queries and managing resources in Snowflake.
CredentialsLocation	Specifies the location of the settings file where credentials are stored for authenticating with Snowflake. This property allows users to provide a custom path to a credentials file or use the default location if not specified. Storing credentials in a file ensures that sensitive information can be securely managed outside of the connection string.
AzureResource	Specifies the Entra ID resource identifier to authenticate against when using Azure Managed Service Identity (MSI) Authscheme or WorkloadIdentityFederation Authscheme with WorkloadIdentityProvider set to AZURE. This property is required when the Azure VM or application is configured to use Azure MSI or Azure Managed Identity to access Snowflake.

Connection

---

Property	Description
UseVirtualHosting	If true (default), buckets will be referenced in the request using the hosted-style request: http://yourbucket.s3.amazonaws.com/yourobject. If set to false, the bean will use the path-style request: http://s3.amazonaws.com/yourbucket/yourobject. Note that this property will be set to false, in case of an S3 based custom service when the CustomURL is specified.

Azure Authentication

---

Property	Description
AzureTenant	Identifies the Snowflake tenant being used to access data. Accepts either the tenant's domain name (for example, contoso.onmicrosoft.com ) or its directory (tenant) ID.

SSO

---

Property	Description
ProofKey	Specifies the Proof Key used for Single Sign-On (SSO) authentication with Snowflake when integrating with external Identity Providers (IdPs) such as Entra ID and PingFederate. This value is typically generated during the OAuth 2.0 Authorization Code Flow.
ExternalToken	Specifies the OAuth or SSO token used for authentication with Snowflake. This property is required when performing Single Sign-On (SSO) or OAuth-based authentication with external identity providers like Entra ID or PingFederate.
SSOProperties	Specifies additional properties required to connect to the identity provider (IdP). These properties are provided as a semicolon-separated list of key-value pairs, and are commonly used for Single Sign-On (SSO) authentication with Okta or other providers.

KeyPairAuth

---

Property	Description
PrivateKey	Specifies the private key used for Key Pair Authentication when connecting to Snowflake. This property allows authentication via a public-private key pair, providing a highly secure alternative to standard password-based authentication. The PrivateKeyType field specifies the type of the certificate store specified by PrivateKey .
PrivateKeyPassword	Specifies the password used to decrypt the private key when using Key Pair Authentication with Snowflake. This property is required when the private key file is encrypted with a password for added security.
PrivateKeyType	Specifies the type of key store or format containing the private key used for Key Pair Authentication with Snowflake. This property allows the user to choose from various formats and storage mechanisms for supplying the private key.
PrivateKeySubject	Specifies the subject name of the certificate containing the private key used for Key Pair Authentication with Snowflake. This property is necessary when the PrivateKeyType is set to USER or MACHINE, indicating that the private key is stored in a certificate store rather than a file or PEM blob.

OAuth

---

Property	Description
InitiateOAuth	Specifies the process for obtaining or refreshing the OAuth access token, which maintains user access while an authenticated, authorized user is working.
OAuthClientId	Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.
OAuthClientSecret	Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).
OAuthAccessToken	Specifies the OAuth access token used to authenticate requests to the data source. This token is issued by the authorization server after a successful OAuth exchange.
CallbackURL	The CallbackURL property specifies the redirect URI (callback URL) used in OAuth authentication flows when connecting to Snowflake. This property is required for external OAuth-based authentication, ensuring that after authentication, the user is redirected correctly.
State	Specifies an optional state parameter used during the OAuth authorization process. This value serves as a mechanism to preserve the application's state between the authorization request and the redirect response. It is commonly used to prevent Cross-Site Request Forgery (CSRF) attacks by validating the authenticity of the request upon receiving the callback.
OAuthSettingsLocation	Specifies the location of the settings file where OAuth values are saved.
Scope	Determines the OAuth scopes that the application requests from Snowflake. Setting appropriate scopes defines the permissions that the application will be granted during the OAuth authorization process.
OAuthAuthorizationURL	The authorization URL for the OAuth service.
OAuthAccessTokenURL	The URL from which the OAuth access token is retrieved.
OAuthVerifier	Specifies a verifier code returned from the OAuthAuthorizationURL . Used when authenticating to OAuth on a headless server, where a browser can't be launched. Requires both OAuthSettingsLocation and OAuthVerifier to be set.
PKCEVerifier	Specifies the Proof Key for Code Exchange (PKCE) Verifier used during the OAuth 2.0 PKCE authentication flow. It is used as input when calling GetOAuthAccessToken . This random value is required when obtaining an access token from the authorization server after the initial authorization code is provided.
OAuthRefreshToken	Specifies the OAuth refresh token used to request a new access token after the original has expired.
OAuthExpiresIn	Specifies the duration in seconds, of an OAuth Access Token's lifetime. The token can be reissued to keep access alive as long as the user keeps working.
OAuthTokenTimestamp	Displays a Unix epoch timestamp in milliseconds that shows how long ago the current access token was created.

JWT OAuth

---

Property	Description
OAuthJWTCert	Supplies the name of the client certificate's JWT Certificate store.
OAuthJWTCertType	Identifies the type of key store containing the JWT Certificate.
OAuthJWTCertPassword	Provides the password for the OAuth JWT certificate used to access a password-protected certificate store. If the certificate store does not require a password, leave this property blank.
OAuthJWTCertSubject	Identifies the subject of the OAuth JWT certificate used to locate a matching certificate in the store. Supports partial matches and the wildcard '*' to select the first certificate.

SSL

---

Property	Description
SSLServerCert	Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Firewall

---

Property	Description
FirewallType	Specifies the protocol the provider uses to tunnel traffic through a proxy-based firewall.
FirewallServer	Identifies the IP address, DNS name, or host name of a proxy used to traverse a firewall and relay user queries to network resources.
FirewallPort	Specifies the TCP port to be used for a proxy-based firewall.
FirewallUser	Identifies the user ID of the account authenticating to a proxy-based firewall.
FirewallPassword	Specifies the password of the user account authenticating to a proxy-based firewall.

Proxy

---

Property	Description
ProxyAutoDetect	Specifies whether the provider checks your system proxy settings for existing proxy server configurations, rather than using a manually specified proxy server.
ProxyServer	Identifies the hostname or IP address of the proxy server through which you want to route HTTP traffic.
ProxyPort	Identifies the TCP port on your specified proxy server that has been reserved for routing HTTP traffic to and from the client.
ProxyAuthScheme	Specifies the authentication method the provider uses when authenticating to the proxy server specified in the ProxyServer connection property.
ProxyUser	Provides the username of a user account registered with the proxy server specified in the ProxyServer connection property.
ProxyPassword	Specifies the password of the user specified in the ProxyUser connection property.
ProxySSLType	Specifies the SSL type to use when connecting to the proxy server specified in the ProxyServer connection property.
ProxyExceptions	Specifies a semicolon-separated list of destination hostnames or IPs that are exempt from connecting through the proxy server set in the ProxyServer connection property.

Logging

---

Property	Description
Logfile	Specifies the file path to the log file where the provider records its activities, such as authentication, query execution, and connection details.
Verbosity	Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.
LogModules	Specifies the core modules to include in the log file. Use a semicolon-separated list of module names. By default, all modules are logged.
MaxLogFileSize	Specifies the maximum size of a single log file in bytes. For example, '10 MB'. When the file reaches the limit, the provider creates a new log file with the date and time appended to the name.
MaxLogFileCount	Specifies the maximum number of log files the provider retains. When the limit is reached, the oldest log file is deleted to make space for a new one.

Schema

---

Property	Description
Location	Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.
BrowsableSchemas	Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .
Tables	Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC .
Views	Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC .
Database	The default database to use for the session when connecting to Snowflake. All SQL queries executed during the session target this database by default.
Schema	Specifies the schema within the Snowflake database to which the connection will be made. Providing a schema name helps narrow down the scope of database objects being accessed, improving performance when retrieving metadata and executing queries.

Miscellaneous

---

Property	Description
AllowPreparedStatement	Determines whether prepared statements are allowed when executing queries in Snowflake.
AllowUserVariables	Determines whether user-defined variables (prefixed by an $) can be used in SQL queries executed through the connection.
ApplicationName	Specifies the name of the application making the connection to Snowflake. This property sets the HTTP User-Agent header for the connection, allowing Snowflake to identify and log queries by application name.
AsyncQueryTimeout	Specifies the maximum duration, in seconds, that the provider will wait for an asynchronous request to complete when downloading large result sets. Asynchronous requests are typically used for executing complex queries or retrieving large datasets where immediate results are not expected. This property ensures that long-running operations do not hang indefinitely.
BatchMode	Specifies the batch operation mode for executing bulk data operations in Snowflake. This property determines whether the connection should use Binding API or Upload API based on the size of the data being processed.
BindingType	Specifies the binding type used for handling Date, Time, and Timestamp_* data types during data insertion operations. This property ensures consistent handling of temporal data when using different APIs for data ingestion.
ClientTimestampNTZTimezone	Controls how to handle the Timestamp_NTZ value since the Timestamp_NTZ type is a value without time zone.
CustomStage	Specifies the name of a custom stage for bulk write operations in Snowflake. Supports internal stages (within Snowflake) and external stages on AWS S3, Azure Blob Storage, or Google Cloud Storage.
ExternalStageAWSAccessKey	Specifies the AWS Access Key ID used to authenticate with an AWS S3 external stage during bulk write operations in Snowflake. This property is necessary when using a CustomStage that references an AWS S3 bucket.
ExternalStageAWSSecretKey	Specifies the AWS Secret Access Key associated with your AWS Access Key ID ( ExternalStageAWSAccessKey ). This property is required for authenticating access to AWS S3 external stages during bulk write operations in Snowflake.
ExternalStageAzureSASToken	Specifies the Azure Blob Storage Shared Access Signature (SAS) token used to authenticate access to an Azure Blob Storage external stage. This property allows Snowflake to interact with Azure Blob Storage containers or objects for bulk data operations. This property is necessary when using a CustomStage that references an Azure location.
ExternalStageEncryptionType	Specifies the encryption mode for the external stage referenced by CustomStage .
ExternalStageGCPAccessToken	Specifies the Google Cloud access token used to authenticate access to a Google Cloud Storage external stage during bulk write operations in Snowflake. This property is necessary when using a CustomStage that references a GCP location.
ExternalStageMasterKey	Specifies the Base64-encoded master key for client-side encryption during bulk write operations.
IgnoreCase	Controls whether case sensitivity is ignored for object names (for example, databases, schemas, tables, and columns) when executing SQL queries.
IncludeTableTypes	Specifies whether the Snowflake connection reports the types of individual tables and views during metadata retrieval. When enabled, the connection returns detailed information about whether objects are standard tables, views, or materialized views.
MaxRows	Specifies the maximum number of rows returned for queries that do not include either aggregation or GROUP BY.
MaxThreads	Specifies the number of concurrent requests.
MergeDelete	A Boolean property that determines whether batch DELETE statements are automatically converted to MERGE statements. This applies only when the DELETE statement's WHERE clause exclusively contains the table's primary key fields combined using the AND logical operator. When enabled, Snowflake attempts to handle deletions more efficiently by using the MERGE mechanism instead of standard batch deletion.
MergeInsert	A Boolean property that determines whether INSERT statements are automatically converted to MERGE statements when executed. This property is applicable only when the INSERT operation includes a table's primary key field. When enabled, Snowflake attempts to upsert records by merging incoming data with existing rows if a primary key conflict occurs, rather than performing a simple insert operation.
MergeUpdate	A Boolean property that determines whether batch UPDATE statements are automatically converted to MERGE statements. This applies only when the UPDATE statement's WHERE clause exclusively includes the table's primary key fields combined using the AND logical operator. When enabled, Snowflake optimizes updates by leveraging the MERGE mechanism instead of standard batch updates.
Other	Specifies advanced connection properties for specialized scenarios. Use this property only under the guidance of our Support team to address specific issues.
QueryPassthrough	This option passes the query to the Snowflake server as is.
Readonly	Toggles read-only access to Snowflake from the provider.
RetryOnChunkTimeout	Specifies whether the connection should retry downloading data chunks from Snowflake when a network issue or timeout occurs.
RTK	Specifies the runtime key for licensing the provider. If unset or invalid, the provider defaults to the standard licensing method. This property is only required in environments where the standard licensing method is unsupported or requires a runtime key.
S3Domain	Specifies the URI of the Amazon S3 bucket used as the Snowflake S3 stage. This property is required when defining external stages for data loading and unloading between Snowflake and S3.
SessionIdleTimeout	Specifies the timeout duration, in minutes, for idle sessions. This setting corresponds to Snowflake's session policy parameter 'SESSION_IDLE_TIMEOUT_MINS'. The default value is 240 minutes, meaning a session is terminated if it remains inactive for more than four hours.
SessionParameters	Specifies additional session parameters to customize the behavior of the Snowflake connection. These parameters are passed as a semicolon-separated list of key-value pairs. Common use cases include setting query tags or modifying identifier handling settings.
Timeout	Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error.

This section provides a complete list of the Authentication properties you can configure in the connection string for this provider.

---

Property	Description
AuthScheme	Specifies the authentication scheme used to establish a connection to Snowflake. It determines the authentication mechanism required for validating the user's identity and allows integration with various SSO and OAuth providers.
Account	The Snowflake account identifier used to connect to a Snowflake instance. The account identifier is usually derived from the URL automatically.
Warehouse	Specifies the name of the Snowflake warehouse to be used for query execution. A warehouse in Snowflake is a virtual compute resource that provides the necessary processing power to perform operations such as data loading, querying, and analytics.
User	Specifies the username used for authenticating with the Snowflake database. The username is required for establishing a successful connection, regardless of the authentication method being used (Password, OKTA, PrivateKey, or OAuth).
Password	Specifies the user's password used for authenticating with Snowflake. This property is required when using password-based authentication methods, including Password, PingFederate, and OKTA.
WorkloadIdentityProvider	Specifies the cloud provider type for Workload Identity Federation authentication with Snowflake. This property is required when AuthScheme is set to WorkloadIdentityFederation.
URL	Set this property to the URL of your Snowflake database instance. This URL is required for establishing a connection to your Snowflake environment and should follow the standard format provided by Snowflake. The URL is typically structured as follows: https://orgname-myaccount.snowflakecomputing.com.
WorkloadIdentityToken	Specifies the OIDC identity token used for Workload Identity Federation authentication with Snowflake. This property is required only when WorkloadIdentityProvider is set to OIDC.
MFAPasscode	Provides a Multi-Factor Authentication (MFA) code when connecting to Snowflake. This code is required when MFA is enabled for your Snowflake account and you are using time-based one-time passwords (TOTP) or push-based authentication methods.
RoleName	Specifies the role assigned to the Snowflake user during authentication. This property determines the access privileges and permissions the user has when executing queries and managing resources in Snowflake.
CredentialsLocation	Specifies the location of the settings file where credentials are stored for authenticating with Snowflake. This property allows users to provide a custom path to a credentials file or use the default location if not specified. Storing credentials in a file ensures that sensitive information can be securely managed outside of the connection string.
AzureResource	Specifies the Entra ID resource identifier to authenticate against when using Azure Managed Service Identity (MSI) Authscheme or WorkloadIdentityFederation Authscheme with WorkloadIdentityProvider set to AZURE. This property is required when the Azure VM or application is configured to use Azure MSI or Azure Managed Identity to access Snowflake.

Specifies the authentication scheme used to establish a connection to Snowflake. It determines the authentication mechanism required for validating the user's identity and allows integration with various SSO and OAuth providers.

Possible Values

Password, OKTA, PrivateKey, AzureMSI, OAuth, OAuthAzureAD, OAuthClientAzureAD, OAuthOKTA, OAuthClientOKTA, OAuthOther, OAuthClientOther, OAuthJWT, PingFederate, ExternalBrowser, ProgrammaticAccessToken, WorkloadIdentityFederation

Data Type

string

Default Value

"OAuth"

Remarks

The connector supports the following authentication mechanisms. See the Getting Started chapter for authentication guides.

• Password: Standard username/password authentication. Recommended for simple authentication setups.
• OKTA: Set this to use the OKTA SSO identity provider. Set SSOProperties in addition to the User and Password you use to authenticate to OKTA.
• AzureMSI: Uses Azure Managed Service Identity (MSI) for authentication. Set this along with AzureResource to use the Azure Managed Service Identity when running on an Azure Virtual Machine (VM).
• PingFederate: Uses PingFederate SSO identity provider for authentication. Set this along with User to use the PingFederate SSO identity provider. When connecting, your browser opens, allowing you to login to PingFederate to complete the authentication.
• PrivateKey: Key pair authentication using RSA key pairs for enhanced security. You must also set PrivateKey, PrivateKeyPassword and PrivateKeyType to authenticate with this method.
• OAuth: Standard OAuth 2.0 authentication using tokens. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. Note that the CData driver always uses PKCE with OAuth for extra security. It works for Snowflake’s built-in OAuth service.
• OAuthAzureAD: Standard OAuth 2.0 authentication using tokens. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. Note that the CData driver always uses PKCE with OAuth for extra security. The Identity Provider (IdP) is the external Entra ID.
• OAuthClientAzureAD: Client grant type OAuth authentication for service-to-service communication. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. The Identity Provider (IdP) is the external Entra ID.
• OAuthOKTA: Standard OAuth 2.0 authentication using tokens. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. Note that the CData driver always uses PKCE with OAuth for extra security. The Identity Provider (IdP) is the external OKTA.
• OAuthClientOKTA: Client grant type OAuth authentication for service-to-service communication. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. The Identity Provider (IdP) is the external OKTA.
• OAuthOther: Standard OAuth 2.0 authentication using tokens. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. Note that the CData driver always uses PKCE with OAuth for extra security. The Identity Provider (IdP) is other external customized application.
• OAuthClientOther: Client grant type OAuth authentication for service-to-service communication. Set OAuthClientId, OAuthClientSecret to the Snowflake OAuth credentials. Additionally, set InitiateOAuth to GETANDREFRESH. The Identity Provider (IdP) is other external customized application.
• OAuthJWT: Set this to perform External OAuth authentication with a JWT certificate. The Identity Provider (IdP) is the external Entra ID. Requires the following additional connection properties. [OAuthJWTCert,/OAuthJWTCertType]
• ExternalBrowser: Uses OneLogin SSO identity provider or other browser-based SSO providers. Set this along with User. When connecting, your browser opens and authentication is completed automatically.
• ProgrammaticAccessToken: Authenticates using a Snowflake Programmatic Access Token (PAT). Set User to the Snowflake username and Password to the PAT token value. PATs can be created in the Snowflake UI under Admin > Security > Programmatic Access Tokens.
• WorkloadIdentityFederation: Authenticates using the cloud platform's native workload identity. The connector automatically obtains attestation credentials from the cloud environment's metadata service (AWS IAM, Azure Managed Identity, or GCP service accounts). Set User to the Snowflake service user and set WorkloadIdentityProvider to specify the cloud provider (AWS, AZURE, GCP, or OIDC). For OIDC, you must also set WorkloadIdentityToken to provide the identity token.

The Snowflake account identifier used to connect to a Snowflake instance. The account identifier is usually derived from the URL automatically.

Data Type

string

Default Value

""

Remarks

The account identifier is usually derived from the Snowflake login URL. For example, if the login URL is https://myorganization-myaccount.snowflakecomputing.com, the account is myorganization-myaccount. If your account includes an AWS cloud region, it would have the format myorganization-myaccount.aws_region. Set this if your Snowflake database URL doesn't include the account name. Use the command SELECT CURRENT_ACCOUNT(); to return the exact account value.

Specifies the name of the Snowflake warehouse to be used for query execution. A warehouse in Snowflake is a virtual compute resource that provides the necessary processing power to perform operations such as data loading, querying, and analytics.

Data Type

string

Default Value

""

Remarks

Provide the name of the Snowflake warehouse you wish to connect to. This warehouse name is required to enable query processing and data manipulation. For example:

Warehouse='MYACCOUNT_WH'

Ensure the specified warehouse is active and accessible for your user account.

Specifies the username used for authenticating with the Snowflake database. The username is required for establishing a successful connection, regardless of the authentication method being used (Password, OKTA, PrivateKey, or OAuth).

Data Type

string

Default Value

""

Remarks

Provide the username associated with your Snowflake account to enable authentication. This username is required when connecting via various authentication schemes, including Password, OAuth, SSO (OKTA, PingFederate), and External Browser.

Specifies the user's password used for authenticating with Snowflake. This property is required when using password-based authentication methods, including Password, PingFederate, and OKTA.

Data Type

string

Default Value

""

Remarks

The Password property is supplied during the connection process along with the User property.

The authentication mechanism (AuthScheme) determines how the password is processed:

• Password: Basic username-password authentication.
• PingFederate: Redirects to a PingFederate endpoint for SSO.
• OKTA: Used in conjunction with an MFA passcode if required.

Once validated, the user is granted access to the Snowflake environment.

Specifies the cloud provider type for Workload Identity Federation authentication with Snowflake. This property is required when AuthScheme is set to WorkloadIdentityFederation.

Possible Values

AWS, AZURE, GCP, OIDC

Data Type

string

Default Value

"OIDC"

Remarks

Set this property to specify which cloud provider's identity to use for authentication.

• AWS: Uses AWS IAM credentials from the EC2 Instance Metadata Service (IMDS) to sign an STS GetCallerIdentity request as the attestation credential.
• AZURE: Uses Azure Managed Identity to obtain an access token from the Azure Instance Metadata Service (IMDS).
• GCP: Uses the GCP metadata service to obtain a Google identity token for the workload.
• OIDC: Uses a user-provided OIDC identity token. Set WorkloadIdentityToken to the token value. This is typically used in CI/CD environments such as GitHub Actions or GitLab CI.

Set this property to the URL of your Snowflake database instance. This URL is required for establishing a connection to your Snowflake environment and should follow the standard format provided by Snowflake. The URL is typically structured as follows: https://orgname-myaccount.snowflakecomputing.com.

Data Type

string

Default Value

""

Remarks

To find your URL:

1. Click your name in the lower left-hand corner of your Snowflake UI.
2. Hover over your Account ID.
3. Click the Copy Account URL icon to copy your account URL.

Specifies the OIDC identity token used for Workload Identity Federation authentication with Snowflake. This property is required only when WorkloadIdentityProvider is set to OIDC.

Data Type

string

Default Value

""

Remarks

Provide the OIDC identity token obtained from your identity provider. This is typically used in CI/CD environments:

• GitHub Actions: Use the ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variable or the GitHub OIDC token request API.
• GitLab CI: Use the CI_JOB_JWT or CI_JOB_JWT_V2 environment variable.
• Other OIDC providers: Provide the JWT identity token from your provider.

Provides a Multi-Factor Authentication (MFA) code when connecting to Snowflake. This code is required when MFA is enabled for your Snowflake account and you are using time-based one-time passwords (TOTP) or push-based authentication methods.

Data Type

string

Default Value

""

Remarks

Allows connecting to Snowflake using a code generated by an MFA application such as Google Authenticator, Duo, or Microsoft Authenticator. The user must supply a one-time code during connection.

Specifies the role assigned to the Snowflake user during authentication. This property determines the access privileges and permissions the user has when executing queries and managing resources in Snowflake.

Data Type

string

Default Value

""

Remarks

The default roles in Snowflake are: PUBLIC, SYSADMIN, or ACCOUNTADMIN.

• PUBLIC: Basic read-only access for most users.
• SYSADMIN: High-level access for managing databases, schemas, and objects.
• ACCOUNTADMIN: Full administrative privileges, including user and account management.

If this value is not set, Snowflake uses the default logged-in user's role. A custom role may also be specified.

Specifies the location of the settings file where credentials are stored for authenticating with Snowflake. This property allows users to provide a custom path to a credentials file or use the default location if not specified. Storing credentials in a file ensures that sensitive information can be securely managed outside of the connection string.

Data Type

string

Default Value

"%APPDATA%\\CData\\Snowflake Data Provider\\CredentialsFile.txt"

Remarks

If left unspecified, the connector will use the default location for storing and retrieving credentials: "%APPDATA%\\CData\\Snowflake Data Provider\\CredentialsFile.txt".

%APPDATA% refers to the user's configuration directory, which varies by operating system:

Platform	%APPDATA%
Windows	The value of the APPDATA environment variable, typically: C:\\Users\\username\\AppData\\Roaming
Linux	~/.config

Specifies the Entra ID resource identifier to authenticate against when using Azure Managed Service Identity (MSI) Authscheme or WorkloadIdentityFederation Authscheme with WorkloadIdentityProvider set to AZURE. This property is required when the Azure VM or application is configured to use Azure MSI or Azure Managed Identity to access Snowflake.

Data Type

string

Default Value

""

Remarks

This property must be specified when using AuthScheme=AzureMSI or AuthScheme=WorkloadIdentityFederation with WorkloadIdentityProvider set to AZURE. In both cases, the Azure Managed Identity requests an access token from the Azure Instance Metadata Service (IMDS) for the resource identified by this URI. Make sure the AzureResource value matches the App ID URI of the application registered in Entra ID. This is ideal for non-interactive authentication scenarios where a Snowflake connection is established from an Azure-hosted service.

This section provides a complete list of the Connection properties you can configure in the connection string for this provider.

---

Property	Description
UseVirtualHosting	If true (default), buckets will be referenced in the request using the hosted-style request: http://yourbucket.s3.amazonaws.com/yourobject. If set to false, the bean will use the path-style request: http://s3.amazonaws.com/yourbucket/yourobject. Note that this property will be set to false, in case of an S3 based custom service when the CustomURL is specified.

If true (default), buckets will be referenced in the request using the hosted-style request: http://yourbucket.s3.amazonaws.com/yourobject. If set to false, the bean will use the path-style request: http://s3.amazonaws.com/yourbucket/yourobject. Note that this property will be set to false, in case of an S3 based custom service when the CustomURL is specified.

Data Type

bool

Default Value

true

Remarks

If true (default), buckets will be referenced in the request using the hosted-style request: http://yourbucket.s3.amazonaws.com/yourobject. If set to false, the bean will use the path-style request: http://s3.amazonaws.com/yourbucket/yourobject. Note that this property will be set to false, in case of an S3 based custom service when the CustomURL is specified.

This section provides a complete list of the Azure Authentication properties you can configure in the connection string for this provider.

---

Property	Description
AzureTenant	Identifies the Snowflake tenant being used to access data. Accepts either the tenant's domain name (for example, contoso.onmicrosoft.com ) or its directory (tenant) ID.

Identifies the Snowflake tenant being used to access data. Accepts either the tenant's domain name (for example, contoso.onmicrosoft.com ) or its directory (tenant) ID.

Data Type

string

Default Value

""

Remarks

A tenant is a digital container for your organization's users and resources, managed through Microsoft Entra ID (formerly Azure AD). Each tenant is associated with a unique directory ID, and often with a custom domain (for example, microsoft.com or contoso.onmicrosoft.com).

To find the directory (tenant) ID in the Microsoft Entra Admin Center, navigate to Microsoft Entra ID > Properties and copy the value labeled "Directory (tenant) ID".

This property is required in the following cases:

• When AuthScheme is set to AzureServicePrincipal or AzureServicePrincipalCert
• When AuthScheme is AzureAD and the user account belongs to multiple tenants

You can provide the tenant value in one of two formats:

• A domain name (for example, contoso.onmicrosoft.com)
• A directory (tenant) ID in GUID format (for example, c9d7b8e4-1234-4f90-bc1a-2a28e0f9e9e0)

Specifying the tenant explicitly ensures that the authentication request is routed to the correct directory, which is especially important when a user belongs to multiple tenants or when using service principal–based authentication.

If this value is omitted when required, authentication may fail or connect to the wrong tenant. This can result in errors such as unauthorized or resource not found.

This section provides a complete list of the SSO properties you can configure in the connection string for this provider.

---

Property	Description
ProofKey	Specifies the Proof Key used for Single Sign-On (SSO) authentication with Snowflake when integrating with external Identity Providers (IdPs) such as Entra ID and PingFederate. This value is typically generated during the OAuth 2.0 Authorization Code Flow.
ExternalToken	Specifies the OAuth or SSO token used for authentication with Snowflake. This property is required when performing Single Sign-On (SSO) or OAuth-based authentication with external identity providers like Entra ID or PingFederate.
SSOProperties	Specifies additional properties required to connect to the identity provider (IdP). These properties are provided as a semicolon-separated list of key-value pairs, and are commonly used for Single Sign-On (SSO) authentication with Okta or other providers.

Specifies the Proof Key used for Single Sign-On (SSO) authentication with Snowflake when integrating with external Identity Providers (IdPs) such as Entra ID and PingFederate. This value is typically generated during the OAuth 2.0 Authorization Code Flow.

Data Type

string

Default Value

""

Remarks

To obtain the ProofKey:

1. Initiate the SSO Flow: Use the GetSSOAuthorizationURL call to generate a Authorization URL for the user to authenticate via the Identity Provider (IdP). The IdP accesses the Authorization URL, authenticates it, and returns a proof key.
2. Provide Proof Key to Snowflake: Set this connection property to the proof key returned by the IdP.

Specifies the OAuth or SSO token used for authentication with Snowflake. This property is required when performing Single Sign-On (SSO) or OAuth-based authentication with external identity providers like Entra ID or PingFederate.

Data Type

string

Default Value

""

Remarks

To obtain an external token:

1. Register your Application with the Identity Provider (IdP).
2. Obtain a Client ID and Client Secret from the IdP.
3. Request an OAuth Token by performing an OAuth authorization flow.
4. Pass the Token as the ExternalToken in your Snowflake connection.

Specifies additional properties required to connect to the identity provider (IdP). These properties are provided as a semicolon-separated list of key-value pairs, and are commonly used for Single Sign-On (SSO) authentication with Okta or other providers.

Data Type

string

Default Value

""

Remarks

This property allows you to define specific connection parameters needed to authenticate with the identity provider. The entries should be formatted as a semicolon-separated list of key-value pairs.

For example, when using Okta as the identity provider:

OKTA

• Domain: The Okta domain you are signing in with, such as: myorg.okta.com
• APIToken: Your Okta API token. Usually unnecessary but can be provided if needed.

Example usage:

SSOProperties='Domain=myorg.okta.com;APIToken=YourOktaToken;'

This section provides a complete list of the KeyPairAuth properties you can configure in the connection string for this provider.

---

Property	Description
PrivateKey	Specifies the private key used for Key Pair Authentication when connecting to Snowflake. This property allows authentication via a public-private key pair, providing a highly secure alternative to standard password-based authentication. The PrivateKeyType field specifies the type of the certificate store specified by PrivateKey .
PrivateKeyPassword	Specifies the password used to decrypt the private key when using Key Pair Authentication with Snowflake. This property is required when the private key file is encrypted with a password for added security.
PrivateKeyType	Specifies the type of key store or format containing the private key used for Key Pair Authentication with Snowflake. This property allows the user to choose from various formats and storage mechanisms for supplying the private key.
PrivateKeySubject	Specifies the subject name of the certificate containing the private key used for Key Pair Authentication with Snowflake. This property is necessary when the PrivateKeyType is set to USER or MACHINE, indicating that the private key is stored in a certificate store rather than a file or PEM blob.

Specifies the private key used for Key Pair Authentication when connecting to Snowflake. This property allows authentication via a public-private key pair, providing a highly secure alternative to standard password-based authentication. The PrivateKeyType field specifies the type of the certificate store specified by PrivateKey .

Data Type

string

Default Value

""

Remarks

The contents of this property is dependent on the PrivateKeyType. This property's content can take one of three forms.

• The certificate store type is a file-based type, such as PEMKEY_FILE, PFXFILE, or PUBLIC_KEY_FILE: this property must be set to the path to the file.
• The certificate store type is a blob-based type, such as PEMKEY_BLOB, PFXBLOB, or PUBLIC_KEY_BLOB: this property must be set to the text content of the file.
• The certificate store type is a Windows-only type such as USER or MACHINE: this property refers to the certificate name.

If the certificate store is password protected, specify the password in PrivateKeyPassword.

Designations of certificate stores are platform-dependent.

The following are designations of the most common User and Machine certificate stores in Windows:

MY	A certificate store holding personal certificates with their associated private keys.
CA	Certifying authority certificates.
ROOT	Root certificates.
SPC	Software publisher certificates.

In Java, the certificate store normally is a file containing certificates and optional private keys.

Specifies the password used to decrypt the private key when using Key Pair Authentication with Snowflake. This property is required when the private key file is encrypted with a password for added security.

Data Type

string

Default Value

""

Remarks

The password for the private key specified in the PrivateKey property, if required.

Specifies the type of key store or format containing the private key used for Key Pair Authentication with Snowflake. This property allows the user to choose from various formats and storage mechanisms for supplying the private key.

Possible Values

USER, MACHINE, PFXFILE, PFXBLOB, JKSFILE, JKSBLOB, PEMKEY_FILE, PEMKEY_BLOB, PUBLIC_KEY_FILE, PUBLIC_KEY_BLOB, SSHPUBLIC_KEY_FILE, SSHPUBLIC_KEY_BLOB, P7BFILE, PPKFILE, XMLFILE, XMLBLOB

Data Type

string

Default Value

"USER"

Remarks

This property can take one of the following values. The value chosen affects the format of the PrivateKey connection property contents:

USER	For Windows, this specifies that the certificate store is a certificate store owned by the current user. Note that this store type is not available in Java.
MACHINE	For Windows, this specifies that the certificate store is a machine store. Note that this store type is not available in Java.
PFXFILE	The certificate store is the name of a PFX (PKCS12) file containing certificates.
PFXBLOB	The certificate store is a string (base-64-encoded) representing a certificate store in PFX (PKCS12) format.
JKSFILE	The certificate store is the name of a Java key store (JKS) file containing certificates. Note that this store type is only available in Java.
JKSBLOB	The certificate store is a string (base-64-encoded) representing a certificate store in JKS format. Note that this store type is only available in Java.
PEMKEY_FILE	The certificate store is the name of a PEM-encoded file that contains a private key and an optional certificate.
PEMKEY_BLOB	The certificate store is a string (base64-encoded) that contains a private key and an optional certificate.
PUBLIC_KEY_FILE	The certificate store is the name of a file that contains a PEM- or DER-encoded public key certificate.
PUBLIC_KEY_BLOB	The certificate store is a string (base-64-encoded) that contains a PEM- or DER-encoded public key certificate.
SSHPUBLIC_KEY_FILE	The certificate store is the name of a file that contains an SSH-style public key.
SSHPUBLIC_KEY_BLOB	The certificate store is a string (base-64-encoded) that contains an SSH-style public key.
P7BFILE	The certificate store is the name of a PKCS7 file containing certificates.
PPKFILE	The certificate store is the name of a file that contains a PuTTY Private Key (PPK).
XMLFILE	The certificate store is the name of a file that contains a certificate in XML format.
XMLBLOB	The certificate store is a string that contains a certificate in XML format.

Specifies the subject name of the certificate containing the private key used for Key Pair Authentication with Snowflake. This property is necessary when the PrivateKeyType is set to USER or MACHINE, indicating that the private key is stored in a certificate store rather than a file or PEM blob.

Data Type

string

Default Value

"*"

Remarks

To obtain the PrivateKeySubject:

1. Open the Certificate Manager (Windows) by pressing Windows+r and entering certmgr.msc (for user certificates) or mmc + Add Certificates snap-in (for machine certificates).
2. Locate the desired certificate.
3. Right-click the certificate and select Properties.
4. Copy the Subject field.
5. Paste this value in the PrivateKeySubject property.

This section provides a complete list of the OAuth properties you can configure in the connection string for this provider.

---

Property	Description
InitiateOAuth	Specifies the process for obtaining or refreshing the OAuth access token, which maintains user access while an authenticated, authorized user is working.
OAuthClientId	Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.
OAuthClientSecret	Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).
OAuthAccessToken	Specifies the OAuth access token used to authenticate requests to the data source. This token is issued by the authorization server after a successful OAuth exchange.
CallbackURL	The CallbackURL property specifies the redirect URI (callback URL) used in OAuth authentication flows when connecting to Snowflake. This property is required for external OAuth-based authentication, ensuring that after authentication, the user is redirected correctly.
State	Specifies an optional state parameter used during the OAuth authorization process. This value serves as a mechanism to preserve the application's state between the authorization request and the redirect response. It is commonly used to prevent Cross-Site Request Forgery (CSRF) attacks by validating the authenticity of the request upon receiving the callback.
OAuthSettingsLocation	Specifies the location of the settings file where OAuth values are saved.
Scope	Determines the OAuth scopes that the application requests from Snowflake. Setting appropriate scopes defines the permissions that the application will be granted during the OAuth authorization process.
OAuthAuthorizationURL	The authorization URL for the OAuth service.
OAuthAccessTokenURL	The URL from which the OAuth access token is retrieved.
OAuthVerifier	Specifies a verifier code returned from the OAuthAuthorizationURL . Used when authenticating to OAuth on a headless server, where a browser can't be launched. Requires both OAuthSettingsLocation and OAuthVerifier to be set.
PKCEVerifier	Specifies the Proof Key for Code Exchange (PKCE) Verifier used during the OAuth 2.0 PKCE authentication flow. It is used as input when calling GetOAuthAccessToken . This random value is required when obtaining an access token from the authorization server after the initial authorization code is provided.
OAuthRefreshToken	Specifies the OAuth refresh token used to request a new access token after the original has expired.
OAuthExpiresIn	Specifies the duration in seconds, of an OAuth Access Token's lifetime. The token can be reissued to keep access alive as long as the user keeps working.
OAuthTokenTimestamp	Displays a Unix epoch timestamp in milliseconds that shows how long ago the current access token was created.

Specifies the process for obtaining or refreshing the OAuth access token, which maintains user access while an authenticated, authorized user is working.

Possible Values

OFF, REFRESH, GETANDREFRESH

Data Type

string

Default Value

"OFF"

Remarks

OAuth is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service. The OAuth flow defines the method to be used for:

• Logging in users.
• Exchanging user credentials for an OAuth access token to be used for authentication.
• Providing limited access to applications.

The options for initiating and maintaining OAuth access are named for the parts of that flow that the connector handles:

OFF	The connector provides no automatic OAuth flow initiation. The OAuth flow is handled entirely by the user. This means that the user must refresh the token manually, and reconnect with an updated OAuthAccessToken property when the current token expires.
GETANDREFRESH	The connector handles the entire OAuth flow (both GET and REFRESH). This means that if a token already exists, the connector refreshes it when necessary; if no token currently exists, the connector obtains it by prompting the user to login.
REFRESH	The user obtains the OAuth Access Token and sets up the sequence for refreshing the OAuth Access Token. (The user is never prompted to log in to authenticate.) After the user logs in, the connector handles the refresh of the OAuth Access Token.

For more information on how to set up OAuth and use this property when configuring a connection, see Establishing a Connection.

Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.

Data Type

string

Default Value

""

Remarks

This property is required in two cases:

• When using a custom OAuth application, such as in web-based authentication flows, service-based authentication, or certificate-based flows that require application registration.
• If the driver does not provide embedded OAuth credentials.

(When the driver provides embedded OAuth credentials, this value may already be provided by the connector and thus not require manual entry.)

OAuthClientId is generally used alongside other OAuth-related properties such as OAuthClientSecret and OAuthSettingsLocation when configuring an authenticated connection.

OAuthClientId is one of the key connection parameters that need to be set before users can authenticate via OAuth. You can usually find this value in your identity provider’s application registration settings. Look for a field labeled Client ID, Application ID, or Consumer Key.

While the client ID is not considered a confidential value like a client secret, it is still part of your application's identity and should be handled carefully. Avoid exposing it in public repositories or shared configuration files.

For more information on how this property is used when configuring a connection, see Establishing a Connection.

Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server. (Custom OAuth applications only.).

Data Type

string

Default Value

""

Remarks

This property (sometimes called the application secret or consumer secret) is required when using a custom OAuth application in any flow that requires secure client authentication, such as web-based OAuth, service-based connections, or certificate-based authorization flows. It is not required when using an embedded OAuth application.

The client secret is used during the token exchange step of the OAuth flow, when the driver requests an access token from the authorization server. If this value is missing or incorrect, authentication fails with either an invalid_client or an unauthorized_client error.

OAuthClientSecret is one of the key connection parameters that need to be set before users can authenticate via OAuth. You can obtain this value from your identity provider when registering the OAuth application.

Notes:

• This value should be stored securely and never exposed in public repositories, scripts, or unsecured environments.
• Client secrets may also expire after a set period. Be sure to monitor expiration dates and rotate secrets as needed to maintain uninterrupted access.

For more information on how this property is used when configuring a connection, see Establishing a Connection

Specifies the OAuth access token used to authenticate requests to the data source. This token is issued by the authorization server after a successful OAuth exchange.

Data Type

string

Default Value

""

Remarks

OAuthAccessToken is a temporary credential that authorizes access to protected resources. It is typically returned by the identity provider after the user or client application completes an OAuth authentication flow. This property is most commonly used in automated workflows or custom OAuth implementations where you want to manage token handling outside of the driver.

The OAuth access token has a server-dependent timeout, limiting user access. The timeout is set using the OAuthExpiresIn property. However, it can be reissued between requests to keep access alive as long as the user keeps working.

If InitiateOAuth is set to REFRESH, we recommend that you also set both OAuthExpiresIn and OAuthTokenTimestamp. The connector uses these properties to determine when the token expires so it can refresh most efficiently. If OAuthExpiresIn and OAuthTokenTimestamp are not specified, the connector refreshes the token immediately.

Note: Access tokens should be treated as sensitive credentials and stored securely. Avoid exposing them in logs, scripts, or configuration files that are not access-controlled.

For more information on how this property is used when configuring a connection, see Establishing a Connection.

The CallbackURL property specifies the redirect URI (callback URL) used in OAuth authentication flows when connecting to Snowflake. This property is required for external OAuth-based authentication, ensuring that after authentication, the user is redirected correctly.

Data Type

string

Default Value

""

Remarks

During the authentication process, the OAuth authorization server redirects the user to this URL. This value must match the callback URL you specify in your Add-In settings, or the authentication will fail. If using Entra ID, Okta, or another OAuth provider, ensure the redirect URI (callback URL) is registered in your identity provider's settings.

Specifies an optional state parameter used during the OAuth authorization process. This value serves as a mechanism to preserve the application's state between the authorization request and the redirect response. It is commonly used to prevent Cross-Site Request Forgery (CSRF) attacks by validating the authenticity of the request upon receiving the callback.

Data Type

string

Default Value

""

Remarks

This property is typically a randomly generated string that your application sends to the authorization server and expects to receive back unchanged. This helps to ensure that the response is coming from the intended request and not from a malicious source.

Example usage: State='xyz123RandomStringForValidation'

This property is for organizations with a particularly high security requirement.

Specifies the location of the settings file where OAuth values are saved.

Data Type

string

Default Value

"%APPDATA%\\CData\\Snowflake Data Provider\\OAuthSettings.txt"

Remarks

Storing OAuth settings in a central location avoids the need for users to enter OAuth connection properties manually each time they log in. It also enables credentials to be shared across connections or processes.

You can store OAuth values in a central file for shared access to those values, in either of the following ways:

• Set InitiateOAuth to either GETANDREFRESH or REFRESH and specify a filepath to the OAuth settings file.
• Use memory storage to load the credentials into static memory.

The following sections provide more detail on each of these methods.

Specifying the OAuthSettingsLocation Filepath

The default OAuth setting location is %APPDATA%\\CData\\Snowflake Data Provider\\OAuthSettings.txt, with %APPDATA% set to the user's configuration directory. Default values vary, depending on the user's operating system.

• Windows (ODBC and Power BI): registry://%DSN%
• Windows: %APPDATA%CDataSnowflake Data Provider\OAuthSettings.txt
• Mac: %APPDATA%/CData/Snowflake Data Provider/OAuthSettings.txt
• Linux: %APPDATA%/CData/Snowflake Data Provider/OAuthSettings.txt

Loading Credentials Via Memory Storage

Memory locations are specified by using a value starting with memory://, followed by a unique identifier for that set of credentials (for example, memory://user1). The identifier can be anything you choose, but it should be unique to the user.

Unlike file-based storage, where credentials persist across connections, memory storage loads the credentials into static memory and the credentials are shared between connections using the same identifier for the life of the process. To persist credentials outside the current process, you must manually store the credentials prior to closing the connection. This enables you to set them in the connection when the process is started again.

To retrieve OAuth property values, query the sys_connection_props system table. If there are multiple connections using the same credentials, the properties are read from the previously closed connection.

Supported Storage Types

• memory://: Stores OAuth tokens in-memory (unique identifier, shared within same process, etc.)
• registry://: Only supported in the Windows ODBC and Power BI editions. Stores OAuth tokens in the registry under the DSN settings. Must end in a DSN name like registry://CData Python Connector for Snowflake Data Source, or registry://%DSN%.
• %DSN%: The name of the DSN you are connecting with.
• Default (no prefix): Stores OAuth tokens within files. The value can be either an absolute path, or a path starting with %APPDATA% or %PROGRAMFILES%.

For more information on how this property is used when configuring a connection, see Establishing a Connection.

Determines the OAuth scopes that the application requests from Snowflake. Setting appropriate scopes defines the permissions that the application will be granted during the OAuth authorization process.

Data Type

string

Default Value

""

Remarks

By default, the connector will request authorization for all available scopes. To restrict permissions, you can specify this property as a space-separated list of desired OAuth scopes, allowing for more granular control over access permissions.

For example, to request only read and write access to user data, you might set the value of this property as:

"read_data write_data"

If you only need to read user profile information, you might use:

"read_profile"

The authorization URL for the OAuth service.

Data Type

string

Default Value

""

Remarks

The authorization URL for the OAuth service. At this URL, the user logs into the server and grants permissions to the application. In OAuth 1.0, if permissions are granted, the request token is authorized.

The URL from which the OAuth access token is retrieved.

Data Type

string

Default Value

""

Remarks

In OAuth 1.0, the authorized request token is exchanged for the access token at this URL.

Specifies a verifier code returned from the OAuthAuthorizationURL . Used when authenticating to OAuth on a headless server, where a browser can't be launched. Requires both OAuthSettingsLocation and OAuthVerifier to be set.

Data Type

string

Default Value

""

Remarks

For detailed instructions about how to obtain the OAuthVerifier value, see Establishing a Connection.

Specifies the Proof Key for Code Exchange (PKCE) Verifier used during the OAuth 2.0 PKCE authentication flow. It is used as input when calling GetOAuthAccessToken . This random value is required when obtaining an access token from the authorization server after the initial authorization code is provided.

Data Type

string

Default Value

""

Remarks

Use PKCEVerifier when integrating with external Identity Providers (IdPs) that support PKCE, such as Entra ID, Okta, or Google Identity.

The PKCEVerifier is usually derived from the GetOAuthAuthorizationUrl call.

Specifies the OAuth refresh token used to request a new access token after the original has expired.

Data Type

string

Default Value

""

Remarks

The refresh token is used to obtain a new access token when the current one expires. It enables seamless authentication for long-running or automated workflows without requiring the user to log in again. This property is especially important in headless, CI/CD, or server-based environments where interactive authentication is not possible.

The refresh token is typically obtained during the initial OAuth exchange by calling the GetOAuthAccessToken stored procedure. After that, it can be set using this property to enable automatic token refresh, or passed to the RefreshOAuthAccessTokenproc; stored procedure if you prefer to manage the refresh manually.

When InitiateOAuth is set to REFRESH, the driver uses this token to retrieve a new access token automatically. After the first refresh, the driver saves updated tokens in the location defined by OAuthSettingsLocation, and uses those values for subsequent connections.

Note: The OAuthRefreshToken should be handled securely and stored in a trusted location. Like access tokens, refresh tokens can expire or be revoked depending on the identity provider’s policies.

For more information on how this property is used when configuring a connection, see Establishing a Connection.

Specifies the duration in seconds, of an OAuth Access Token's lifetime. The token can be reissued to keep access alive as long as the user keeps working.

Data Type

string

Default Value

""

Remarks

The OAuth Access Token is assigned to an authenticated user, granting that user access to the network for a specified period of time. The access token is used in place of the user's login ID and password, which stay on the server.

An access token created by the server is only valid for a limited time. OAuthExpiresIn is the number of seconds the token is valid from when it was created. For example, a token generated at 2024-01-29 20:00:00 UTC that expires at 2024-01-29 21:00:00 UTC (an hour later) would have an OAuthExpiresIn value of 3600, no matter what the current time is.

To determine how long the user has before the Access Token will expire, check OAuthTokenTimestamp.

Displays a Unix epoch timestamp in milliseconds that shows how long ago the current access token was created.

Data Type

string

Default Value

""

Remarks

The OAuth access token is assigned to an authenticated user, granting that user access to the network for a specified period of time. The access token is used in place of the user's login ID and password, which stay on the server.

An access token created by the server is only valid for a limited time. OAuthTokenTimestamp is the Unix timestamp when the server created the token. For example, OAuthTokenTimestamp=1706558400 indicates the OAuthAccessToken was generated by the server at 2024-01-29 20:00:00 UTC.

This section provides a complete list of the JWT OAuth properties you can configure in the connection string for this provider.

---

Property	Description
OAuthJWTCert	Supplies the name of the client certificate's JWT Certificate store.
OAuthJWTCertType	Identifies the type of key store containing the JWT Certificate.
OAuthJWTCertPassword	Provides the password for the OAuth JWT certificate used to access a password-protected certificate store. If the certificate store does not require a password, leave this property blank.
OAuthJWTCertSubject	Identifies the subject of the OAuth JWT certificate used to locate a matching certificate in the store. Supports partial matches and the wildcard '*' to select the first certificate.

Supplies the name of the client certificate's JWT Certificate store.

Data Type

string

Default Value

""

Remarks

The OAuthJWTCertType field specifies the type of the certificate store specified in OAuthJWTCert. If the store is password-protected, use OAuthJWTCertPassword to supply the password..

OAuthJWTCert is used in conjunction with the OAuthJWTCertSubject field in order to specify client certificates. If OAuthJWTCert has a value, and OAuthJWTCertSubject is set, the CData Python Connector for Snowflake initiates a search for a certificate. For further information, see OAuthJWTCertSubject.

Designations of certificate stores are platform-dependent.

Notes

• The most common User and Machine certificate stores in Windows include:
  • MY: A certificate store holding personal certificates with their associated private keys.
  • CA: Certifying authority certificates.
  • ROOT: Root certificates.
  • SPC: Software publisher certificates.
• In Java, the certificate store normally is a file containing certificates and optional private keys.
• When the certificate store type is PFXFile, this property must be set to the name of the file.
• When the type is PFXBlob, the property must be set to the binary contents of a PFX file (i.e. PKCS12 certificate store).

Identifies the type of key store containing the JWT Certificate.

Possible Values

USER, MACHINE, PFXFILE, PFXBLOB, JKSFILE, JKSBLOB, PEMKEY_FILE, PEMKEY_BLOB, PUBLIC_KEY_FILE, PUBLIC_KEY_BLOB, SSHPUBLIC_KEY_FILE, SSHPUBLIC_KEY_BLOB, P7BFILE, PPKFILE, XMLFILE, XMLBLOB, BCFKSFILE, BCFKSBLOB

Data Type

string

Default Value

"USER"

Remarks

Value	Description	Notes
USER	A certificate store owned by the current user.	Only available in Windows.
MACHINE	A machine store.	Not available in Java or other non-Windows environments.
PFXFILE	A PFX (PKCS12) file containing certificates.
PFXBLOB	A string (base-64-encoded) representing a certificate store in PFX (PKCS12) format.
JKSFILE	A Java key store (JKS) file containing certificates.	Only available in Java.
JKSBLOB	A string (base-64-encoded) representing a certificate store in Java key store (JKS) format.	Only available in Java.
PEMKEY_FILE	A PEM-encoded file that contains a private key and an optional certificate.
PEMKEY_BLOB	A string (base64-encoded) that contains a private key and an optional certificate.
PUBLIC_KEY_FILE	A file that contains a PEM- or DER-encoded public key certificate.
PUBLIC_KEY_BLOB	A string (base-64-encoded) that contains a PEM- or DER-encoded public key certificate.
SSHPUBLIC_KEY_FILE	A file that contains an SSH-style public key.
SSHPUBLIC_KEY_BLOB	A string (base-64-encoded) that contains an SSH-style public key.
P7BFILE	A PKCS7 file containing certificates.
PPKFILE	A file that contains a PPK (PuTTY Private Key).
XMLFILE	A file that contains a certificate in XML format.
XMLBLOB	Astring that contains a certificate in XML format.
BCFKSFILE	A file that contains an Bouncy Castle keystore.
BCFKSBLOB	A string (base-64-encoded) that contains a Bouncy Castle keystore.

Provides the password for the OAuth JWT certificate used to access a password-protected certificate store. If the certificate store does not require a password, leave this property blank.

Data Type

string

Default Value

""

Remarks

This property specifies the password needed to open a password-protected certificate store. To determine if a password is necessary, refer to the documentation or configuration for your specific certificate store.

Identifies the subject of the OAuth JWT certificate used to locate a matching certificate in the store. Supports partial matches and the wildcard '*' to select the first certificate.

Data Type

string

Default Value

"*"

Remarks

The value of this property is used to locate a matching certificate in the store. The search process works as follows:

• If an exact match for the subject is found, the corresponding certificate is selected.
• If no exact match is found, the store is searched for certificates whose subjects contain the property value.
• If no match is found, no certificate is selected.

You can set the value to '*' to automatically select the first certificate in the store. The certificate subject is a comma-separated list of distinguished name fields and values. For example: CN=www.server.com, OU=test, C=US, E=support@cdata.com.

Common fields include:

Field	Meaning
CN	Common Name. This is commonly a host name like www.server.com.
O	Organization
OU	Organizational Unit
L	Locality
S	State
C	Country
E	Email Address

If a field value contains a comma, enclose it in quotes. For example: "O=ACME, Inc.".

This section provides a complete list of the SSL properties you can configure in the connection string for this provider.

---

Property	Description
SSLServerCert	Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Data Type

string

Default Value

""

Remarks

If you are using a TLS/SSL connection, use this property to specify the TLS/SSL certificate to be accepted from the server. If you specify a value for this property, all other certificates that are not trusted by the machine are rejected.

This property can take the following forms:

Description	Example
A full PEM Certificate (example shortened for brevity)	-----BEGIN CERTIFICATE----- MIIChTCCAe4CAQAwDQYJKoZIhv......Qw== -----END CERTIFICATE-----
A path to a local file containing the certificate	C:\cert.cer
The public key (example shortened for brevity)	-----BEGIN RSA PUBLIC KEY----- MIGfMA0GCSq......AQAB -----END RSA PUBLIC KEY-----
The MD5 Thumbprint (hex values can also be either space- or colon-separated)	ecadbdda5a1529c58a1e9e09828d70e4
The SHA1 Thumbprint (hex values can also be either space- or colon-separated)	34a929226ae0819f2ec14b4a3d904f801cbb150d

Note: It is possible to use '*' to signify that all certificates should be accepted, but due to security concerns this is not recommended.

This section provides a complete list of the Firewall properties you can configure in the connection string for this provider.

---

Property	Description
FirewallType	Specifies the protocol the provider uses to tunnel traffic through a proxy-based firewall.
FirewallServer	Identifies the IP address, DNS name, or host name of a proxy used to traverse a firewall and relay user queries to network resources.
FirewallPort	Specifies the TCP port to be used for a proxy-based firewall.
FirewallUser	Identifies the user ID of the account authenticating to a proxy-based firewall.
FirewallPassword	Specifies the password of the user account authenticating to a proxy-based firewall.

Specifies the protocol the provider uses to tunnel traffic through a proxy-based firewall.

Possible Values

NONE, TUNNEL, SOCKS4, SOCKS5

Data Type

string

Default Value

"NONE"

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

Note: By default, the connector connects to the system proxy. To disable this behavior and connect to one of the following proxy types, set ProxyAutoDetect to false.

The following table provides port number information for each of the supported protocols.

Protocol	Default Port	Description
TUNNEL	80	The port where the connector opens a connection to Snowflake. Traffic flows back and forth via the proxy at this location.
SOCKS4	1080	The port where the connector opens a connection to Snowflake. SOCKS 4 then passes theFirewallUser value to the proxy, which determines whether the connection request should be granted.
SOCKS5	1080	The port where the connector sends data to Snowflake. If the SOCKS 5 proxy requires authentication, set FirewallUser and FirewallPassword to credentials the proxy recognizes.

To connect to HTTP proxies, use ProxyServer and ProxyPort. To authenticate to HTTP proxies, use ProxyAuthScheme, ProxyUser, and ProxyPassword.

Identifies the IP address, DNS name, or host name of a proxy used to traverse a firewall and relay user queries to network resources.

Data Type

string

Default Value

""

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

Specifies the TCP port to be used for a proxy-based firewall.

Data Type

int

Default Value

0

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

Identifies the user ID of the account authenticating to a proxy-based firewall.

Data Type

string

Default Value

""

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

Specifies the password of the user account authenticating to a proxy-based firewall.

Data Type

string

Default Value

""

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

This section provides a complete list of the Proxy properties you can configure in the connection string for this provider.

---

Property	Description
ProxyAutoDetect	Specifies whether the provider checks your system proxy settings for existing proxy server configurations, rather than using a manually specified proxy server.
ProxyServer	Identifies the hostname or IP address of the proxy server through which you want to route HTTP traffic.
ProxyPort	Identifies the TCP port on your specified proxy server that has been reserved for routing HTTP traffic to and from the client.
ProxyAuthScheme	Specifies the authentication method the provider uses when authenticating to the proxy server specified in the ProxyServer connection property.
ProxyUser	Provides the username of a user account registered with the proxy server specified in the ProxyServer connection property.
ProxyPassword	Specifies the password of the user specified in the ProxyUser connection property.
ProxySSLType	Specifies the SSL type to use when connecting to the proxy server specified in the ProxyServer connection property.
ProxyExceptions	Specifies a semicolon-separated list of destination hostnames or IPs that are exempt from connecting through the proxy server set in the ProxyServer connection property.

Specifies whether the provider checks your system proxy settings for existing proxy server configurations, rather than using a manually specified proxy server.

Data Type

bool

Default Value

true

Remarks

When this connection property is set to True, the connector checks your system proxy settings for existing proxy server configurations (no need to manually supply proxy server details).

This connection property takes precedence over other proxy settings. If you want to configure the connector to connect to a specific proxy server, set ProxyAutoDetect to False.

On Windows, the connector reads the proxy settings from the Internet Options in the registry, specifically the registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\. On Windows 10 and later, this corresponds to the Proxy Settings found in the Windows Settings.

Note that these settings apply only to the current user of the machine. If you're running an application as a service, the connector does not read your own user's settings. You must instead manually supply the proxy settings in the connector's connection properties.

On Mac, the connector reads proxy settings from the system-configured CFNetwork settings.

On Linux, this property is unsupported, and is set to False by default.

To connect to an HTTP proxy, see ProxyServer. For other proxies, such as SOCKS or tunneling, see FirewallType.

Identifies the hostname or IP address of the proxy server through which you want to route HTTP traffic.

Data Type

string

Default Value

""

Remarks

The connector only routes HTTP traffic through the proxy server specified in this connection property when ProxyAutoDetect is set to False.

If ProxyAutoDetect is set to True (the default), the connector instead routes HTTP traffic through the proxy server specified in your system proxy settings.

Identifies the TCP port on your specified proxy server that has been reserved for routing HTTP traffic to and from the client.

Data Type

int

Default Value

80

Remarks

The connector only routes HTTP traffic through the ProxyServer port specified in this connection property when ProxyAutoDetect is set to False.

If ProxyAutoDetect is set to True (the default), the connector instead routes HTTP traffic through the proxy server port specified in your system proxy settings.

For other proxy types, see FirewallType.

Specifies the authentication method the provider uses when authenticating to the proxy server specified in the ProxyServer connection property.

Possible Values

BASIC, DIGEST, NONE, NEGOTIATE, NTLM

Data Type

string

Default Value

"BASIC"

Remarks

Note: The connector only uses this ProxyAuthScheme when ProxyAutoDetect is set to False. If ProxyAutoDetect is set to True (the default), the connector instead uses the authentication method specified in your system proxy settings.

Supported authentication types :

• BASIC: The connector performs HTTP basic authentication.
• DIGEST: The connector performs HTTP digest authentication.
• NTLM: The connector retrieves an NTLM token.
• NEGOTIATE: The connector retrieves an NTLM or Kerberos token based on the applicable protocol for authentication.
• NONE: Signifies that the ProxyServer does not require authentication.

For all values other than NONE, you must also set the ProxyUser and ProxyPassword connection properties.

If you need to use another authentication type, such as SOCKS 5 authentication, see FirewallType.

Provides the username of a user account registered with the proxy server specified in the ProxyServer connection property.

Data Type

string

Default Value

""

Remarks

The ProxyUser and ProxyPassword connection properties are used to connect and authenticate against the HTTP proxy specified in ProxyServer.

After selecting one of the available authentication types in ProxyAuthScheme, set this property as follows:

ProxyAuthScheme Value	Value to set for ProxyUser
BASIC	The username of a user registered with the proxy server.
DIGEST	The username of a user registered with the proxy server.
NEGOTIATE	The username of a Windows user who is a valid user in the domain or trusted domain that the proxy server is part of, in the format user@domain or domain\user.
NTLM	The username of a Windows user who is a valid user in the domain or trusted domain that the proxy server is part of, in the format user@domain or domain\user.
NONE	Do not set the ProxyPassword connection property.

Note: The connector only uses this username if ProxyAutoDetect is set to False. If ProxyAutoDetect is set to True (the default), the connector instead uses the username specified in your system proxy settings.

Specifies the password of the user specified in the ProxyUser connection property.

Data Type

string

Default Value

""

Remarks

The ProxyUser and ProxyPassword connection properties are used to connect and authenticate against the HTTP proxy specified in ProxyServer.

After selecting one of the available authentication types in ProxyAuthScheme, set this property as follows:

ProxyAuthScheme Value	Value to set for ProxyPassword
BASIC	The password associated with the proxy server user specified in ProxyUser.
DIGEST	The password associated with the proxy server user specified in ProxyUser.
NEGOTIATE	The password associated with the Windows user account specified in ProxyUser.
NTLM	The password associated with the Windows user account specified in ProxyUser.
NONE	Do not set the ProxyPassword connection property.

For SOCKS 5 authentication or tunneling, see FirewallType.

Note: The connector only uses this password if ProxyAutoDetect is set to False. If ProxyAutoDetect is set to True (the default), the connector instead uses the password specified in your system proxy settings.

Specifies the SSL type to use when connecting to the proxy server specified in the ProxyServer connection property.

Possible Values

AUTO, ALWAYS, NEVER, TUNNEL

Data Type

string

Default Value

"AUTO"

Remarks

This property determines when to use SSL for the connection to the HTTP proxy specified by ProxyServer. You can set this connection property to the following values :

AUTO	Default setting. If ProxyServer is set to an HTTPS URL, the connector uses the TUNNEL option. If ProxyServer is set to an HTTP URL, the component uses the NEVER option.
ALWAYS	The connection is always SSL enabled.
NEVER	The connection is not SSL enabled.
TUNNEL	The connection is made through a tunneling proxy. The proxy server opens a connection to the remote host and traffic flows back and forth through the proxy.

Specifies a semicolon-separated list of destination hostnames or IPs that are exempt from connecting through the proxy server set in the ProxyServer connection property.

Data Type

string

Default Value

""

Remarks

The ProxyServer is used for all addresses, except for addresses defined in this property. Use semicolons to separate entries.

Note: The connector uses the system proxy settings by default, without further configuration needed. If you want to explicitly configure proxy exceptions for this connection, set ProxyAutoDetect to False.

This section provides a complete list of the Logging properties you can configure in the connection string for this provider.

---

Property	Description
Logfile	Specifies the file path to the log file where the provider records its activities, such as authentication, query execution, and connection details.
Verbosity	Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.
LogModules	Specifies the core modules to include in the log file. Use a semicolon-separated list of module names. By default, all modules are logged.
MaxLogFileSize	Specifies the maximum size of a single log file in bytes. For example, '10 MB'. When the file reaches the limit, the provider creates a new log file with the date and time appended to the name.
MaxLogFileCount	Specifies the maximum number of log files the provider retains. When the limit is reached, the oldest log file is deleted to make space for a new one.

Specifies the file path to the log file where the provider records its activities, such as authentication, query execution, and connection details.

Data Type

string

Default Value

""

Remarks

This property specifies the location and name of the log file where the connector records its operations, including authentication events, query execution, and connection details. If the specified file does not exist, the connector creates it. Ensure that the user or the service running the connector has write access to the specified path or file. Without sufficient permissions, the log file is not created.

Sensitive information from the connection string, such as passwords and tokens, is automatically masked in the logs. However, sensitive information present in the data itself may not be masked.

If you specify a relative path for Logfile, and if the Location property is set, that directory is used as the base path for the log file.

Additional properties allow you to customize logging behavior:

• Use Verbosity to control the level of detail of the log file.
• Manage log file size with MaxLogFileSize and control the number of retained log files with MaxLogFileCount.
• Filter specific log modules by adjusting the LogModules property.

Specifies the verbosity level of the log file, which controls the amount of detail logged. Supported values range from 1 to 5.

Data Type

string

Default Value

"1"

Remarks

This property defines the level of detail the connector includes in the log file. Higher verbosity levels increase the detail of the logged information, but may also result in larger log files and slower performance due to the additional data being captured.

The default verbosity level is 1, which is recommended for regular operation. Higher verbosity levels are primarily intended for debugging purposes. For more information on each level, refer to Logging.

When combined with the LogModules property, Verbosity can refine logging to specific categories of information.

Specifies the core modules to include in the log file. Use a semicolon-separated list of module names. By default, all modules are logged.

Data Type

string

Default Value

""

Remarks

The connector writes details about each operation it performs into the logfile specified by the Logfile connection property.

Each of these logged operations are assigned to a themed category called a module, and each module has a corresponding short code used to labels individual connector operations as belonging to that module.

When this connection property is set to a semicolon-separated list of module codes, only operations belonging to the specified modules are written to the logfile. Note that this only affects which operations are logged moving forward and doesn't retroactively alter the existing contents of the logfile. For example: INFO;EXEC;SSL;META;

By default, logged operations from all modules are included.

You can explicitly exclude a module by prefixing it with a "-". For example: -HTTP

To apply filters to submodules, identify them with the syntax <module name>.<submodule name>. For example, the following value causes the connector to only log actions belonging to the HTTP module, and further refines it to exclude actions belonging to the Res submodule of the HTTP module: HTTP;-HTTP.Res

Note that the logfile filtering triggered by the Verbosity connection property takes precedence over the filtering imposed by this connection property. This means that operations of a higher verbosity level than the level specified in the Verbosity connection property are not printed in the logfile, even if they belong to one of the modules specified in this connection property.

The available modules and submodules are:

Module Name	Module Description	Submodules
INFO	General Information. Includes the connection string, product version (build number), and initial connection messages.	Connec – Information related to creating or destroying connections. Messag – Generic label for messages pertaining to connections, the connection string, and product version. These messages are typically specific to the connector, rather than being received and passed along directly from the service.
EXEC	Query Execution. Includes execution messages for user-written SQL queries, parsed SQL queries, and normalized SQL queries. Success/failure messages for queries and query pages appear here as well.	Messag – Messages pertaining to query execution. These messages are typically specific to the connector, rather than being received and passed along directly from the service. Normlz – Query normalization steps. Query normalization is when the product takes the user-submitted query and rewrites the query to get the same results with optimal performance. Origin – This label applies to any messages recording a user's original query (the exact, unaltered, non-normalized query executed by the user). Page – Messages related to query paging. Parsed – Query parsing steps. Parsing is the process of converting the user-submitted query into a standardized format for easier processing.
HTTP	HTTP protocol messages. Includes HTTP requests/responses (including POST messages), as well as Kerberos related messages.	KERB – HTTP requests related to Kerberos. Messag – Messages pertaining to HTTP protocols. These messages are typically specific to the connector, rather than being received and passed along directly from the service. Unpack – This label applies to messages about zipped data being returned from the service API and unpacked by the product. Res – Messages containing HTTP responses. Req – Messages containing HTTP requests.
WSDL	Messages pertaining to the generation of WSDL/XSD files.	—
SSL	SSL certificate messages.	Certif – Messages pertaining to SSL certificates.
AUTH	Authentication related failure/success messages.	Messag – Messages pertaining to authentication. These messages are typically specific to the connector, rather than being received and passed along directly from the service. OAuth – Messages related to OAuth authentication. Krbros – Kerberos-related authentication messages.
SQL	Includes SQL transactions, SQL bulk transfer messages, and SQL result set messages.	Bulk – Messages pertaining to bulk query execution. Cache – Messages related to reading row data from and writing row data to the product's cache for better performance. Messag – Messages pertaining to SQL transactions. These messages are typically specific to the connector, rather than being received and passed along directly from the service. ResSet – Query resultsets. Transc – Messages related to handling transactions, including information about the number of jobs executed and backup table handling.
META	Metadata cache and schema messages.	Cache – Messages related to reading from and modifying column and table definitions in the product's cache for better performance. Schema – Messages related to retrieving metadata from or modifying the service schema. MemSto – Messages related to writing to or reading from in-memory metadata cache. Storag – Messages relating to storing metadata on disk or in an external data store, rather than in memory.
FUNC	Information related to executing SQL functions.	Errmsg – Error messages related to executing SQL functions.
TCP	Incoming and outgoing raw bytes on TCP transport layer messages.	Send – Raw data sent via the TCP protocol. Receiv – Raw data received via the TCP protocol.
FTP	Messages pertaining to the File Transfer Protocol.	Info – Status messages related to communication in the FTP protocol. Client – Messages related to actions taken by the FTP client (the product) during FTP communication. Server – Messages related to actions taken by the FTP server during FTP communication.
SFTP	Messages pertaining to the Secure File Transfer Protocol.	Info – Status messages related to communication in the SFTP protocol. To_Server – Messages related to actions taken by the SFTP client (the product) during SFTP communication. From_Server – Messages related to actions taken by the SFTP server during SFTP communication.
POP	Messages pertaining to data transferred via the Post Office Protocol.	Client – Messages related to actions taken by the POP client (the product) during POP communication. Server – Messages related to actions taken by the POP server during POP communication. Status – Status messages related to communication in the POP protocol.
SMTP	Messages pertaining to data transferred via the Simple Mail Transfer Protocol.	Client – Messages related to actions taken by the SMTP client (the product) during SMTP communication. Server – Messages related to actions taken by the SMTP server during SMTP communication. Status – Status messages related to communication in the SMTP protocol.
CORE	Messages relating to various internal product operations not covered by other modules.	—
DEMN	Messages related to SQL remoting.	—
CLJB	Messages about bulk data uploads (cloud job).	Commit – Submissions for bulk data uploads.
SRCE	Miscellaneous messages produced by the product that don't belong in any other module.	—
TRANCE	Advanced messages concerning low-level product operations.	—

Specifies the maximum size of a single log file in bytes. For example, '10 MB'. When the file reaches the limit, the provider creates a new log file with the date and time appended to the name.

Data Type

string

Default Value

"100MB"

Remarks

For values lower than 100 KB, the connector uses 100 KB as the minimum allowable size.

To control the total number of log files retained, use the MaxLogFileCount property in conjunction with this property. Together, these properties allow you to manage the size and retention of log files effectively.

Specifies the maximum number of log files the provider retains. When the limit is reached, the oldest log file is deleted to make space for a new one.

Data Type

int

Default Value

-1

Remarks

Each log file name includes the date and time for easier identification.

This property accepts the following values:

• A value of 2 or higher sets the maximum number of log files retained.
• A value of 1 retains only one log file. When it reaches the maximum size, the file is deleted and replaced by a new one, leaving no history beyond the current log.
• A value of 0 or negative indicates no limit on the number of log files, and logging continues indefinitely.

To manage log file size, use the MaxLogFileSize property. The two properties work together to control the size and retention of log files in the logging folder.

This section provides a complete list of the Schema properties you can configure in the connection string for this provider.

---

Property	Description
Location	Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.
BrowsableSchemas	Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .
Tables	Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC .
Views	Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC .
Database	The default database to use for the session when connecting to Snowflake. All SQL queries executed during the session target this database by default.
Schema	Specifies the schema within the Snowflake database to which the connection will be made. Providing a schema name helps narrow down the scope of database objects being accessed, improving performance when retrieving metadata and executing queries.

Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.

Data Type

string

Default Value

"%APPDATA%\\CData\\Snowflake Data Provider\\Schema"

Remarks

The Location property is only needed if you want to either customize definitions (for example, change a column name, ignore a column, etc.) or extend the data model with new tables, views, or stored procedures.

If left unspecified, the default location is %APPDATA%\\CData\\Snowflake Data Provider\\Schema, where %APPDATA% is set to the user's configuration directory:

Platform	%APPDATA%
Windows	The value of the APPDATA environment variable
Linux	~/.config

Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .

Data Type

string

Default Value

""

Remarks

Listing all available database schemas can take extra time, thus degrading performance. Providing a list of schemas in the connection string saves time and improves performance.

Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC .

Data Type

string

Default Value

""

Remarks

Listing all available tables from some databases can take extra time, thus degrading performance. Providing a list of tables in the connection string saves time and improves performance.

If there are lots of tables available and you already know which ones you want to work with, you can use this property to restrict your viewing to only those tables. To do this, specify the tables you want in a comma-separated list. Each table should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Tables=TableA,[TableB/WithSlash],WithCatalog.WithSchema.`TableC With Space`.

Note: If you are connecting to a data source with multiple schemas or catalogs, you must specify each table you want to view by its fully qualified name. This avoids ambiguity between tables that may exist in multiple catalogs or schemas.

Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC .

Data Type

string

Default Value

""

Remarks

Listing all available views from some databases can take extra time, thus degrading performance. Providing a list of views in the connection string saves time and improves performance.

If there are lots of views available and you already know which ones you want to work with, you can use this property to restrict your viewing to only those views. To do this, specify the views you want in a comma-separated list. Each view should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Views=ViewA,[ViewB/WithSlash],WithCatalog.WithSchema.`ViewC With Space`.

Note: If you are connecting to a data source with multiple schemas or catalogs, you must specify each view you want to examine by its fully qualified name. This avoids ambiguity between views that may exist in multiple catalogs or schemas.

The default database to use for the session when connecting to Snowflake. All SQL queries executed during the session target this database by default.

Data Type

string

Default Value

""

Remarks

The Database property simplifies your queries if you normally work with one database during a session. If you work with multiple databases in the same session, do not set this property. If you do not set this property, use the fully qualified path to tables and schemas in SQL queries.

Specifies the schema within the Snowflake database to which the connection will be made. Providing a schema name helps narrow down the scope of database objects being accessed, improving performance when retrieving metadata and executing queries.

Data Type

string

Default Value

""

Remarks

By specifying a schema, you can reduce the scope of metadata retrieval, which is particularly useful when working with large databases. If not specified, the connection may default to the schema defined by the user's default role or configuration.

This section provides a complete list of the Miscellaneous properties you can configure in the connection string for this provider.

---

Property	Description
AllowPreparedStatement	Determines whether prepared statements are allowed when executing queries in Snowflake.
AllowUserVariables	Determines whether user-defined variables (prefixed by an $) can be used in SQL queries executed through the connection.
ApplicationName	Specifies the name of the application making the connection to Snowflake. This property sets the HTTP User-Agent header for the connection, allowing Snowflake to identify and log queries by application name.
AsyncQueryTimeout	Specifies the maximum duration, in seconds, that the provider will wait for an asynchronous request to complete when downloading large result sets. Asynchronous requests are typically used for executing complex queries or retrieving large datasets where immediate results are not expected. This property ensures that long-running operations do not hang indefinitely.
BatchMode	Specifies the batch operation mode for executing bulk data operations in Snowflake. This property determines whether the connection should use Binding API or Upload API based on the size of the data being processed.
BindingType	Specifies the binding type used for handling Date, Time, and Timestamp_* data types during data insertion operations. This property ensures consistent handling of temporal data when using different APIs for data ingestion.
ClientTimestampNTZTimezone	Controls how to handle the Timestamp_NTZ value since the Timestamp_NTZ type is a value without time zone.
CustomStage	Specifies the name of a custom stage for bulk write operations in Snowflake. Supports internal stages (within Snowflake) and external stages on AWS S3, Azure Blob Storage, or Google Cloud Storage.
ExternalStageAWSAccessKey	Specifies the AWS Access Key ID used to authenticate with an AWS S3 external stage during bulk write operations in Snowflake. This property is necessary when using a CustomStage that references an AWS S3 bucket.
ExternalStageAWSSecretKey	Specifies the AWS Secret Access Key associated with your AWS Access Key ID ( ExternalStageAWSAccessKey ). This property is required for authenticating access to AWS S3 external stages during bulk write operations in Snowflake.
ExternalStageAzureSASToken	Specifies the Azure Blob Storage Shared Access Signature (SAS) token used to authenticate access to an Azure Blob Storage external stage. This property allows Snowflake to interact with Azure Blob Storage containers or objects for bulk data operations. This property is necessary when using a CustomStage that references an Azure location.
ExternalStageEncryptionType	Specifies the encryption mode for the external stage referenced by CustomStage .
ExternalStageGCPAccessToken	Specifies the Google Cloud access token used to authenticate access to a Google Cloud Storage external stage during bulk write operations in Snowflake. This property is necessary when using a CustomStage that references a GCP location.
ExternalStageMasterKey	Specifies the Base64-encoded master key for client-side encryption during bulk write operations.
IgnoreCase	Controls whether case sensitivity is ignored for object names (for example, databases, schemas, tables, and columns) when executing SQL queries.
IncludeTableTypes	Specifies whether the Snowflake connection reports the types of individual tables and views during metadata retrieval. When enabled, the connection returns detailed information about whether objects are standard tables, views, or materialized views.
MaxRows	Specifies the maximum number of rows returned for queries that do not include either aggregation or GROUP BY.
MaxThreads	Specifies the number of concurrent requests.
MergeDelete	A Boolean property that determines whether batch DELETE statements are automatically converted to MERGE statements. This applies only when the DELETE statement's WHERE clause exclusively contains the table's primary key fields combined using the AND logical operator. When enabled, Snowflake attempts to handle deletions more efficiently by using the MERGE mechanism instead of standard batch deletion.
MergeInsert	A Boolean property that determines whether INSERT statements are automatically converted to MERGE statements when executed. This property is applicable only when the INSERT operation includes a table's primary key field. When enabled, Snowflake attempts to upsert records by merging incoming data with existing rows if a primary key conflict occurs, rather than performing a simple insert operation.
MergeUpdate	A Boolean property that determines whether batch UPDATE statements are automatically converted to MERGE statements. This applies only when the UPDATE statement's WHERE clause exclusively includes the table's primary key fields combined using the AND logical operator. When enabled, Snowflake optimizes updates by leveraging the MERGE mechanism instead of standard batch updates.
Other	Specifies advanced connection properties for specialized scenarios. Use this property only under the guidance of our Support team to address specific issues.
QueryPassthrough	This option passes the query to the Snowflake server as is.
Readonly	Toggles read-only access to Snowflake from the provider.
RetryOnChunkTimeout	Specifies whether the connection should retry downloading data chunks from Snowflake when a network issue or timeout occurs.
RTK	Specifies the runtime key for licensing the provider. If unset or invalid, the provider defaults to the standard licensing method. This property is only required in environments where the standard licensing method is unsupported or requires a runtime key.
S3Domain	Specifies the URI of the Amazon S3 bucket used as the Snowflake S3 stage. This property is required when defining external stages for data loading and unloading between Snowflake and S3.
SessionIdleTimeout	Specifies the timeout duration, in minutes, for idle sessions. This setting corresponds to Snowflake's session policy parameter 'SESSION_IDLE_TIMEOUT_MINS'. The default value is 240 minutes, meaning a session is terminated if it remains inactive for more than four hours.
SessionParameters	Specifies additional session parameters to customize the behavior of the Snowflake connection. These parameters are passed as a semicolon-separated list of key-value pairs. Common use cases include setting query tags or modifying identifier handling settings.
Timeout	Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error.

Determines whether prepared statements are allowed when executing queries in Snowflake.

Data Type

bool

Default Value

false

Remarks

A prepared statement is a SQL query that is precompiled and can be executed multiple times with different parameters.

The default value for this property is 'false', meaning that statements are parsed each time they are executed. Leave the default setting if you are executing many different queries only once, or if you have complex queries.

If you are executing the same query repeatedly, you will generally see better performance by setting this property to 'true'. Preparing the query avoids recompiling the same query over and over. However, prepared statements also require the connector to keep the connection active and open while the statement is prepared.

Determines whether user-defined variables (prefixed by an $) can be used in SQL queries executed through the connection.

Data Type

bool

Default Value

false

Remarks

When set to 'true', user variables (prefixed by an $) can be used in SQL queries. By default, identifiers prefixed with $ are treated as command parameters rather than user-defined variables.

Specifies the name of the application making the connection to Snowflake. This property sets the HTTP User-Agent header for the connection, allowing Snowflake to identify and log queries by application name.

Data Type

string

Default Value

""

Remarks

Snowflake logs the application name in query history and session information, making it useful for tracking and monitoring queries from different applications connecting to the same Snowflake environment. It can identify which applications generate heavy workloads. If not specified, Snowflake assigns a default value (often the client driver name).

You can view the ApplicationName in Snowflake's QUERY_HISTORY table.

Specifies the maximum duration, in seconds, that the provider will wait for an asynchronous request to complete when downloading large result sets. Asynchronous requests are typically used for executing complex queries or retrieving large datasets where immediate results are not expected. This property ensures that long-running operations do not hang indefinitely.

Data Type

int

Default Value

300

Remarks

If this property is set to 0, asynchronous operations will run until completion, regardless of how long they take, unless an error condition occurs. This property is different from Timeout, which governs the timeout for individual HTTP operations.

When dealing with large datasets, setting a reasonable timeout value ensures that the operation will terminate if it exceeds the specified duration, helping to prevent resource exhaustion or prolonged processing.

If the AsyncQueryTimeout limit is reached and the asynchronous request has not completed, the connector will raise an error condition indicating that the request was unsuccessful due to a timeout.

Specifies the batch operation mode for executing bulk data operations in Snowflake. This property determines whether the connection should use Binding API or Upload API based on the size of the data being processed.

Possible Values

Auto, Binding, Upload

Data Type

string

Default Value

"Auto"

Remarks

There are three accepted values: Auto (default), Binding, and Upload.

• Auto: Automatically selects the API based on the count of values. Uses Binding API if below the threshold defined by the session parameter client_binding_threshold. Otherwise, uses Upload API.
• Binding: Forces the use of the Binding API regardless of data size. Suitable for smaller data batches.
• Upload: Forces the use of the Upload API regardless of data size. Recommended for larger bulk uploads.

Forcing Binding or Upload can improve performance if you know the data size will always be small or large, respectively.

Specifies the binding type used for handling Date, Time, and Timestamp_* data types during data insertion operations. This property ensures consistent handling of temporal data when using different APIs for data ingestion.

Possible Values

DEFAULT, TEXT

Data Type

string

Default Value

"DEFAULT"

Remarks

There are two kinds of binding types: DEFAULT and TEXT.

• DEFAULT: Uses native binding types: DATE for Date, TIME for Time, and TIMESTAMP_* for Timestamp. By default, the driver selects either the Binding API or Upload API based on the number of records, unless BatchMode is specified.

  The behavior for TIMESTAMP_* types is determined by the session parameter CLIENT_TIMESTAMP_TYPE_MAPPING. However, when using the Upload API, this session parameter does not apply, potentially causing inconsistent timestamp values when inserting different quantities of records.

• TEXT: Uses TEXT binding for Date, Time, and Timestamp_* types. This ensures consistent timestamp handling across both the Binding API and Upload API, regardless of the number of records being inserted.

  If you need consistent timestamp handling across Binding API and Upload API, use BindingType=TEXT.

Controls how to handle the Timestamp_NTZ value since the Timestamp_NTZ type is a value without time zone.

Possible Values

Local, UTC, Unspecified

Data Type

string

Default Value

"Local"

Remarks

Specifies the name of a custom stage for bulk write operations in Snowflake. Supports internal stages (within Snowflake) and external stages on AWS S3, Azure Blob Storage, or Google Cloud Storage.

Data Type

string

Default Value

""

Remarks

If the stage is external, provide the corresponding AWS, Azure, or GCP credentials via ExternalStageAWSAccessKey/ExternalStageAWSSecretKey, ExternalStageAzureSASToken, or ExternalStageGCPAccessToken.

If the external stage uses client-side encryption, set ExternalStageEncryptionType to CSE and provide the key in ExternalStageMasterKey.

When the CustomStage property is left unspecified, the connector generates a temporary stage automatically during the upload process and delete it after the upload is complete.

To avoid parsing errors with the generated CSV, you should include the FIELD_OPTIONALLY_ENCLOSED_BY parameter on the stage definition and set it to the double quote character. Otherwise, you may face parsing issues if you have string values that contain special characters in CSV (such as commas or double quotes).

For example:

CREATE STAGE "TEST_STAGE_CDATA" FILE_FORMAT = (FIELD_OPTIONALLY_ENCLOSED_BY='\"' )

Use internal stages for small to medium-sized data or external stages for integrating with cloud storage systems like AWS S3, Azure Blob Storage, or Google Cloud Storage.

Specifies the AWS Access Key ID used to authenticate with an AWS S3 external stage during bulk write operations in Snowflake. This property is necessary when using a CustomStage that references an AWS S3 bucket.

Data Type

string

Default Value

""

Remarks

Your AWS account access key. This value is accessible from your AWS security credentials page:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number and select My Security Credentials in the menu that is displayed.
3. Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.

Specifies the AWS Secret Access Key associated with your AWS Access Key ID ( ExternalStageAWSAccessKey ). This property is required for authenticating access to AWS S3 external stages during bulk write operations in Snowflake.

Data Type

string

Default Value

""

Remarks

Your AWS account secret key. This value is accessible from your AWS security credentials page:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number and select My Security Credentials in the menu that is displayed.
3. Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.

Specifies the Azure Blob Storage Shared Access Signature (SAS) token used to authenticate access to an Azure Blob Storage external stage. This property allows Snowflake to interact with Azure Blob Storage containers or objects for bulk data operations. This property is necessary when using a CustomStage that references an Azure location.

Data Type

string

Default Value

""

Remarks

The string value of the Azure Blob shared access signature.

In the Azure Portal, go to Shared access signature in the Settings section for your Azure Blob container. Click Generate SAS token and URL and copy the value from the Blob SAS token textbox. Please be careful to select the proper permissions (Create, Write, Delete) in the Permissions dropdown list and the validity of the Start and Expiration time before you generate the SAS token.

Specifies the encryption mode for the external stage referenced by CustomStage .

Possible Values

CSE, SSE, NONE

Data Type

string

Default Value

"NONE"

Remarks

This property only applies when CustomStage points to an external stage.

• CSE: Client-side encryption. Requires ExternalStageMasterKey.
• SSE: Server-side encryption. Handled by the cloud provider; no driver action needed.
• NONE: No encryption.

Specifies the Google Cloud access token used to authenticate access to a Google Cloud Storage external stage during bulk write operations in Snowflake. This property is necessary when using a CustomStage that references a GCP location.

Data Type

string

Default Value

""

Remarks

Provide the access token for the Google Cloud Storage external stage referenced by CustomStage.

Specifies the Base64-encoded master key for client-side encryption during bulk write operations.

Data Type

string

Default Value

""

Remarks

This property is required when ExternalStageEncryptionType is set to CSE. Provide the same master key configured for the external stage in Snowflake.

Controls whether case sensitivity is ignored for object names (for example, databases, schemas, tables, and columns) when executing SQL queries.

Data Type

bool

Default Value

false

Remarks

The default value is 'false' (object names are case sensitive). This property is useful for legacy systems that do not enforce case sensitivity.

Specifies whether the Snowflake connection reports the types of individual tables and views during metadata retrieval. When enabled, the connection returns detailed information about whether objects are standard tables, views, or materialized views.

Data Type

bool

Default Value

false

Remarks

Set IncludeTableTypes to 'true' if your application requires metadata type information. Enabling this option may increase data retrieval time slightly, especially in schemas with a large number of objects.

Specifies the maximum number of rows returned for queries that do not include either aggregation or GROUP BY.

Data Type

int

Default Value

-1

Remarks

The default value for this property, -1, means that no row limit is enforced unless the query explicitly includes a LIMIT clause. (When a query includes a LIMIT clause, the value specified in the query takes precedence over the MaxRows setting.)

Setting MaxRows to a whole number greater than 0 ensures that queries do not return excessively large result sets by default.

This property is useful for optimizing performance and preventing excessive resource consumption when executing queries that could otherwise return very large datasets.

Specifies the number of concurrent requests.

Data Type

string

Default Value

"5"

Remarks

This property allows you to issue multiple requests simultaneously, thereby improving performance.

A Boolean property that determines whether batch DELETE statements are automatically converted to MERGE statements. This applies only when the DELETE statement's WHERE clause exclusively contains the table's primary key fields combined using the AND logical operator. When enabled, Snowflake attempts to handle deletions more efficiently by using the MERGE mechanism instead of standard batch deletion.

Data Type

bool

Default Value

false

Remarks

MergeDelete allows for upsert functionality. This property is primarily intended for use with tools where you have no direct control over the queries being executed. Otherwise, as long as Query Passthrough is 'true', you could execute the MERGE command directly.

When this property is 'false', DELETE bulk statements are executed against the server. When it is set to 'true' and the DELETE query contains the primary key field, Snowflake sends a MERGE query that executes a DELETE if match is found in Snowflake.

For example this query:

DELETE FROM "Table" WHERE "ID" = 1 AND "NAME" = 'Jerry'

is sent to Snowflake as the following MERGE request:

MERGE INTO "Table" AS "Target" USING "RTABLE1_TMP_20eca05b-c050-47dd-89bc-81c7f617f877" AS "Source" ON ("Target"."ID" = "Source"."ID" AND "Target"."NAME" = "Source"."NAME") 
WHEN MATCHED THEN DELETE



A Boolean property that determines whether INSERT statements are automatically converted to MERGE statements when executed. This property is applicable only when the INSERT operation includes a table's primary key field. When enabled, Snowflake attempts to upsert records by merging incoming data with existing rows if a primary key conflict occurs, rather than performing a simple insert operation.

Data Type

bool

Default Value

false

Remarks

MergeInsert allows for upsert functionality. This property is primarily intended for use with tools where you have no direct control over the queries being executed. Otherwise, as long as Query Passthrough is 'true', you could execute the MERGE command directly.

When this property is 'false', INSERT statements are executed directly against the server. When it is set to 'true' and the INSERT query contains the primary key field, the Snowflake sends a MERGE query that executes an INSERT if no match is found in Snowflake or an UPDATE if it is found. For example this query:

INSERT INTO "Table" ("ID", "NAME", "AGE") VALUES (1, 'NewName', 10)

is sent to Snowflake as the following MERGE request:

MERGE INTO "Table" AS "Target" USING (SELECT 1 AS "ID") AS [Source] ON ("Target"."ID" = "Source"."ID") 
WHEN NOT MATCHED THEN INSERT ("ID", "NAME", "AGE") VALUES (1, 'NewName', 10) 
WHEN MATCHED THEN UPDATE SET "NAME" = 'NewName', "AGE" = 10



A Boolean property that determines whether batch UPDATE statements are automatically converted to MERGE statements. This applies only when the UPDATE statement's WHERE clause exclusively includes the table's primary key fields combined using the AND logical operator. When enabled, Snowflake optimizes updates by leveraging the MERGE mechanism instead of standard batch updates.

Data Type

bool

Default Value

false

Remarks

MergeUpdate allows for upsert functionality. This property is primarily intended for use with tools where you have no direct control over the queries being executed. Otherwise, as long as Query Passthrough is 'true', you could execute the MERGE command directly.

When this property is 'false', UPDATE statements are executed directly against the server. When it is set to 'true' and the UPDATE query contains the primary key field, Snowflake sends a MERGE query that executes an UPDATE if a match is found in Snowflake. For example this query:

UPDATE "Table" SET "NAME" = 'NewName', "AGE" = 10 WHERE "ID" = 1

is sent to Snowflake as the following MERGE request:

MERGE INTO "Table" AS "Target" USING "RTABLE1_TMP_20eca05b-c050-47dd-89bc-81c7f617f877" AS "Source" ON ("Target"."ID" = "Source"."ID") 
WHEN MATCHED THEN UPDATE SET "Target"."NAME" = "Source"."NAME", "Target"."AGE" = "Source"."AGE"

Specifies advanced connection properties for specialized scenarios. Use this property only under the guidance of our Support team to address specific issues.

Data Type

string

Default Value

""

Remarks

This property allows advanced users to configure hidden properties for specialized situations, with the advice of our Support team. These settings are not required for normal use cases but can address unique requirements or provide additional functionality. To define multiple properties, use a semicolon-separated list.

Note: It is strongly recommended to set these properties only when advised by the Support team to address specific scenarios or issues.

Integration and Formatting

Property	Description
DefaultColumnSize	Sets the default length of string fields when the data source does not provide column length in the metadata. The default value is 2000.
ConvertDateTimeToGMT=True	Converts date-time values to GMT, instead of the local time of the machine. The default value is False (use local time).
RecordToFile=filename	Records the underlying socket data transfer to the specified file.

This option passes the query to the Snowflake server as is.

Data Type

bool

Default Value

false

Remarks

When this is set, queries are passed through directly to Snowflake.

Toggles read-only access to Snowflake from the provider.

Data Type

bool

Default Value

false

Remarks

When set to True, the connector allows only SELECT queries. Attempting an INSERT, UPDATE, DELETE, or stored procedure query fails with an error message.

Specifies whether the connection should retry downloading data chunks from Snowflake when a network issue or timeout occurs.

Data Type

bool

Default Value

false

Remarks

Typically if a network issue such as a timeout occurs during chunk downloading of data, the CData Python Connector for Snowflake throws an exception. Set this property to 'true' to cause the CData Python Connector for Snowflake to attempt retrying the request before failing.

Specifies the runtime key for licensing the provider. If unset or invalid, the provider defaults to the standard licensing method. This property is only required in environments where the standard licensing method is unsupported or requires a runtime key.

Data Type

string

Default Value

""

Remarks

This property is typically unnecessary, as most configurations support a standard licensing mechanism.

Warning: The value of this property takes precedence over all existing licensing information. To avoid licensing errors, ensure the provided runtime key is correct.

Specifies the URI of the Amazon S3 bucket used as the Snowflake S3 stage. This property is required when defining external stages for data loading and unloading between Snowflake and S3.

Data Type

string

Default Value

""

Remarks

Generally, the default domain is "s3.amazonaws.com". However, for Chinese S3 regions, the default domain is "s3.{region}.amazonaws.com.cn". Ensure the specified domain matches the region of your S3 bucket for proper connectivity.

Specifies the timeout duration, in minutes, for idle sessions. This setting corresponds to Snowflake's session policy parameter 'SESSION_IDLE_TIMEOUT_MINS'. The default value is 240 minutes, meaning a session is terminated if it remains inactive for more than four hours.

Data Type

int

Default Value

240

Remarks

For example, changing the setting of this property to "60" terminates an idle session after one hour of inactivity.

Specifies additional session parameters to customize the behavior of the Snowflake connection. These parameters are passed as a semicolon-separated list of key-value pairs. Common use cases include setting query tags or modifying identifier handling settings.

Data Type

string

Default Value

""

Remarks

This property allows the user to define session-specific configurations for Snowflake.

For example, the following session parameters sets a query tag for tracking purposes and allows case-insensitive handling of quoted identifiers. They are separated by a semicolon.

This property is used in rare cases only.

SessionParameters='QUERY_TAG=MyTag;QUOTED_IDENTIFIERS_IGNORE_CASE=True;'

Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error.

Data Type

int

Default Value

120

Remarks

The timeout applies to each individual communication with the server rather than the entire query or operation. For example, a query could continue running beyond 60 seconds if each paging call completes within the timeout limit.

Timeout is set to 60 seconds by default. To disable timeouts, set this property to 0.

Disabling the timeout allows operations to run indefinitely until they succeed or fail due to other conditions such as server-side timeouts, network interruptions, or resource limits on the server.

Note: Use this property cautiously to avoid long-running operations that could degrade performance or result in unresponsive behavior.

LZMA from 7Zip LZMA SDK

LZMA SDK is placed in the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original LZMA SDK code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.

LZMA2 from XZ SDK

Version 1.9 and older are in the public domain.

Xamarin.Forms

Xamarin SDK

The MIT License (MIT)

Copyright (c) .NET Foundation Contributors

All rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

NSIS 3.10

Copyright (C) 1999-2025 Contributors THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS COMMON PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.

1. DEFINITIONS

"Contribution" means:

a) in the case of the initial Contributor, the initial code and documentation distributed under this Agreement, and b) in the case of each subsequent Contributor:

i) changes to the Program, and

ii) additions to the Program;

where such changes and/or additions to the Program originate from and are distributed by that particular Contributor. A Contribution 'originates' from a Contributor if it was added to the Program by such Contributor itself or anyone acting on such Contributor's behalf. Contributions do not include additions to the Program which: (i) are separate modules of software distributed in conjunction with the Program under their own license agreement, and (ii) are not derivative works of the Program.

"Contributor" means any person or entity that distributes the Program.

"Licensed Patents " mean patent claims licensable by a Contributor which are necessarily infringed by the use or sale of its Contribution alone or when combined with the Program.

"Program" means the Contributions distributed in accordance with this Agreement.

"Recipient" means anyone who receives the Program under this Agreement, including all Contributors.

2. GRANT OF RIGHTS

a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, distribute and sublicense the Contribution of such Contributor, if any, and such derivative works, in source code and object code form.

b) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed Patents to make, use, sell, offer to sell, import and otherwise transfer the Contribution of such Contributor, if any, in source code and object code form. This patent license shall apply to the combination of the Contribution and the Program if, at the time the Contribution is added by the Contributor, such addition of the Contribution causes such combination to be covered by the Licensed Patents. The patent license shall not apply to any other combinations which include the Contribution. No hardware per se is licensed hereunder.

c) Recipient understands that although each Contributor grants the licenses to its Contributions set forth herein, no assurances are provided by any Contributor that the Program does not infringe the patent or other intellectual property rights of any other entity. Each Contributor disclaims any liability to Recipient for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, each Recipient hereby assumes sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow Recipient to distribute the Program, it is Recipient's responsibility to acquire that license before distributing the Program.

d) Each Contributor represents that to its knowledge it has sufficient copyright rights in its Contribution, if any, to grant the copyright license set forth in this Agreement.

3. REQUIREMENTS

A Contributor may choose to distribute the Program in object code form under its own license agreement, provided that:

a) it complies with the terms and conditions of this Agreement; and

b) its license agreement:

i) effectively disclaims on behalf of all Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose;

ii) effectively excludes on behalf of all Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits;

iii) states that any provisions which differ from this Agreement are offered by that Contributor alone and not by any other party; and

iv) states that source code for the Program is available from such Contributor, and informs licensees how to obtain it in a reasonable manner on or through a medium customarily used for software exchange.

When the Program is made available in source code form:

a) it must be made available under this Agreement; and

b) a copy of this Agreement must be included with each copy of the Program.

Contributors may not remove or alter any copyright notices contained within the Program.

Each Contributor must identify itself as the originator of its Contribution, if any, in a manner that reasonably allows subsequent Recipients to identify the originator of the Contribution.

4. COMMERCIAL DISTRIBUTION

Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense.

For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, or offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages.

5. NO WARRANTY

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations.

6. DISCLAIMER OF LIABILITY

EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

7. GENERAL

If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable.

If Recipient institutes patent litigation against a Contributor with respect to a patent applicable to software (including a cross-claim or counterclaim in a lawsuit), then any patent licenses granted by that Contributor to such Recipient under this Agreement shall terminate as of the date such litigation is filed. In addition, if Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed.

All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive.

Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. IBM is the initial Agreement Steward. IBM may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to distribute the Program (including its Contributions) under the new version. Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved.

This Agreement is governed by the laws of the State of New York and the intellectual property laws of the United States of America. No party to this Agreement will bring a legal action under this Agreement more than one year after the cause of action arose. Each party waives its rights to a jury trial in any resulting litigation.

AdoptOpenJDK / Adoptium Temurin JRE 17.0.18_8

Copyright (c) Eclipse Foundation AISBL. All Rights Reserved.

Apache License, Version 2.0

TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.

"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.

"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.

"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.

"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.

"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.

"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).

"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.

"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."

"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.

2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.

3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.

4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:

1. You must give any other recipients of the Work or Derivative Works a copy of this License; and
2. You must cause any modified files to carry prominent notices stating that You changed the files; and
3. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
4. If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.

You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.

5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.

6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.

7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.

8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.

9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.

END OF TERMS AND CONDITIONS

Eclipse Distribution License - v 1.0

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

• Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
• Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
• Neither the name of the Eclipse Foundation, Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Eclipse Public License - v 2.0

THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.

1. DEFINITIONS "Contribution" means:

• a) in the case of the initial Contributor, the initial content Distributed under this Agreement, and
• b) in the case of each subsequent Contributor:
  • i) changes to the Program, and
  • ii) additions to the Program;
  where such changes and/or additions to the Program originate from and are Distributed by that particular Contributor. A Contribution "originates" from a Contributor if it was added to the Program by such Contributor itself or anyone acting on such Contributor's behalf. Contributions do not include changes or additions to the Program that are not Modified Works.

"Contributor" means any person or entity that Distributes the Program. "Licensed Patents" mean patent claims licensable by a Contributor which are necessarily infringed by the use or sale of its Contribution alone or when combined with the Program.

"Program" means the Contributions Distributed in accordance with this Agreement.

"Recipient" means anyone who receives the Program under this Agreement or any Secondary License (as applicable), including Contributors.

"Derivative Works" shall mean any work, whether in Source Code or other form, that is based on (or derived from) the Program and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship.

"Modified Works" shall mean any work in Source Code or other form that results from an addition to, deletion from, or modification of the contents of the Program, including, for purposes of clarity any new file in Source Code form that contains any contents of the Program. Modified Works shall not include works that contain only declarations, interfaces, types, classes, structures, or files of the Program solely in each case in order to link to, bind by name, or subclass the Program or Modified Works thereof.

"Distribute" means the acts of a) distributing or b) making available in any manner that enables the transfer of a copy.

"Source Code" means the form of a Program preferred for making modifications, including but not limited to software source code, documentation source, and configuration files.

"Secondary License" means either the GNU General Public License, Version 2.0, or any later versions of that license, including any exceptions or additional permissions as identified by the initial Contributor.

2. GRANT OF RIGHTS

• a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, Distribute and sublicense the Contribution of such Contributor, if any, and such Derivative Works.
• b) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed Patents to make, use, sell, offer to sell, import and otherwise transfer the Contribution of such Contributor, if any, in Source Code or other form. This patent license shall apply to the combination of the Contribution and the Program if, at the time the Contribution is added by the Contributor, such addition of the Contribution causes such combination to be covered by the Licensed Patents. The patent license shall not apply to any other combinations which include the Contribution. No hardware per se is licensed hereunder.
• c) Recipient understands that although each Contributor grants the licenses to its Contributions set forth herein, no assurances are provided by any Contributor that the Program does not infringe the patent or other intellectual property rights of any other entity. Each Contributor disclaims any liability to Recipient for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, each Recipient hereby assumes sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow Recipient to Distribute the Program, it is Recipient's responsibility to acquire that license before distributing the Program.
• d) Each Contributor represents that to its knowledge it has sufficient copyright rights in its Contribution, if any, to grant the copyright license set forth in this Agreement.
• e) Notwithstanding the terms of any Secondary License, no Contributor makes additional grants to any Recipient (other than those set forth in this Agreement) as a result of such Recipient's receipt of the Program under the terms of a Secondary License (if permitted under the terms of Section 3).

3. REQUIREMENTS 3.1 If a Contributor Distributes the Program in any form, then:

• a) the Program must also be made available as Source Code, in accordance with section 3.2, and the Contributor must accompany the Program with a statement that the Source Code for the Program is available under this Agreement, and informs Recipients how to obtain it in a reasonable manner on or through a medium customarily used for software exchange; and
• b) the Contributor may Distribute the Program under a license different than this Agreement, provided that such license:
  • i) effectively disclaims on behalf of all other Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose;
  • ii) effectively excludes on behalf of all other Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits;
  • iii) does not attempt to limit or alter the recipients' rights in the Source Code under section 3.2; and
  • iv) requires any subsequent distribution of the Program by any party to be under a license that satisfies the requirements of this section 3.

3.2 When the Program is Distributed as Source Code:

• a) it must be made available under this Agreement, or if the Program (i) is combined with other material in a separate file or files made available under a Secondary License, and (ii) the initial Contributor attached to the Source Code the notice described in Exhibit A of this Agreement, then the Program may be made available under the terms of such Secondary Licenses, and
• b) a copy of this Agreement must be included with each copy of the Program.

3.3 Contributors may not remove or alter any copyright, patent, trademark, attribution notices, disclaimers of warranty, or limitations of liability (‘notices') contained within the Program from any copy of the Program which they Distribute, provided that Contributors may add their own appropriate notices.

4. COMMERCIAL DISTRIBUTION Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense.

For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, or offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages.

5. NO WARRANTY EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations.

6. DISCLAIMER OF LIABILITY EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

7. GENERAL If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable.

If Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed.

All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive.

Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse Foundation may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be Distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to Distribute the Program (including its Contributions) under the new version.

Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved. Nothing in this Agreement is intended to be enforceable by any entity that is not a Contributor or Recipient. No third-party beneficiary rights are created under this Agreement.

Exhibit A – Form of Secondary Licenses Notice "This Source Code may also be made available under the following Secondary Licenses when the conditions for such availability set forth in the Eclipse Public License, v. 2.0 are satisfied: {name license(s), version(s), and exceptions or additional permissions here}."

Simply including a copy of this Agreement, including this Exhibit A is not sufficient to license the Source Code under Secondary Licenses.

If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE file in a relevant directory) where a recipient would be likely to look for such a notice.

You may add additional accurate notices of copyright ownership.

GNU Classpath

Classpath is distributed under the terms of the GNU General Public License with the following clarification and special exception.

Linking this library statically or dynamically with other modules is making a combined work based on this library. Thus, the terms and conditions of the GNU General Public License cover the whole combination.

As a special exception, the copyright holders of this library give you permission to link this library with independent modules to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify this library, you may extend this exception to your version of the library, but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version.

As such, it can be used to run, create and distribute a large class of applications and applets. When GNU Classpath is used unmodified as the core class library for a virtual machine, compiler for the java languge, or for a program written in the java programming language it does not affect the licensing for distributing those programs directly.

OpenJDK Assembly Exception

The OpenJDK source code made available by Oracle America, Inc. (Oracle) at openjdk.java.net ("OpenJDK Code") is distributed under the terms of the GNU General Public License <http://www.gnu.org/copyleft/gpl.html> version 2 only ("GPL2"), with the following clarification and special exception.

Linking this OpenJDK Code statically or dynamically with other code is making a combined work based on this library. Thus, the terms and conditions of GPL2 cover the whole combination.

As a special exception, Oracle gives you permission to link this OpenJDK Code with certain code licensed by Oracle as indicated at http://openjdk.java.net/legal/exception-modules-2007-05-08.html ("Designated Exception Modules") to produce an executable, regardless of the license terms of the Designated Exception Modules, and to copy and distribute the resulting executable under GPL2, provided that the Designated Exception Modules continue to be governed by the licenses under which they were offered by Oracle.

As such, it allows licensees and sublicensees of Oracle's GPL2 OpenJDK Code to build an executable that includes those portions of necessary code that Oracle could not provide under GPL2 (or that Oracle has provided under GPL2 with the Classpath exception). If you modify or add to the OpenJDK code, that new GPL2 code may still be combined with Designated Exception Modules if the new code is made subject to this exception by its copyright holder.