Pull from Snowflake
Before you get started, check to see if your team has already set up their Client ID and Client Secret for Parabola. If you or someone else on your team has already set this up on the Snowflake side, you will not need to go through this process again and can jump straight to the Parabola Step Set Up section**.**
Connect your Snowflake account
In order to perform these steps, you must have the right permission level in Snowflake to create a security integration.
Login to your Snowflake account. Once you’re logged in, click on “Worksheets” tab in the sidebar and click + Worksheet button in the upper right hand corner
In the worksheet, paste the query below into the worksheets query box. This will instantiate a custom client OAuth server on your Snowflake instance that Parabola will use to connect to.
create security integration oauth_parabola_prod
type = oauth
enabled = true
oauth_client = custom
oauth_client_type = 'CONFIDENTIAL'
oauth_redirect_uri = 'https://parabola.io/api/auth/snowflake/callback'
oauth_issue_refresh_tokens = true
oauth_refresh_token_validity = 86400
The configuration above is the basic default settings for OAuth server up, but can be customized further for your needs. Additional information located on Snowflake documents here.
Click the Run/Play button. If successful, you should see a notification on the lower portion of the screen confirming integration creation was successful.
Retrieving the Client ID and Client Secret
Run the following query:
Note: The name of your integration passed into this statement should be all capitalized. Ex “oauth_parabola_prod” should be entered as 'OAUTH_PARABOLA_PROD'
Click on the result in the lower half of the page and copy the oauth_client_id and oauth_client_secret values in the resulting json
Parabola Step Set Up
In your builder, bring in the Snowflake step and Click on “Authorize Snowflake”. You will see a form asking for client_id, client_secret, and account_identifier. For client_id and client_secret, paste the values you received above.
For account_identifier, paste your Snowflake account id. Your account ID will be the located in your URL:
If your Snowflake URL has a region included in it, along with an account identifier, you may need to include that region as well in this step.
After you hit Submit, a module will pop up which will ask to authenticate. Login to your Snowflake account as you always would. After logging in, you should be taken back to Parabola. You will now be able to query data from Snowflake!
When a user authorizes our "Pull from Snowflake" step, their access to data within the Parabola step will be the same as their access to data within the Snowflake platform. If a user has granular permissions configured in Snowflake, their access will be gated in the same fashion within Parabola.
While credentials like Client ID and Client Secret are at the organization level, when a user actually authenticates the step through their Snowflake login, we ensure that the actual user account permissions are enforced within the step itself.
By default Parabola will mimic the permissions you have within your Snowflake instance. The request will check the users default role, warehouse, and database/schema. If these values are not set, or the users default values are not sufficient to make a certain request, you will see an error message like below:
Settings Error: Error occurred with Snowflake API (status_code: 422, message: “SQL compilation error: Object ‘CUSTOMER’ does not exist or not authorized.”)
If this occurs, open up the settings on the left-hand side labeled Connection Options and manually enter the values you would like to use to make a query:
You can play around with these values in the Snowflake worksheets section to find a configuration that works for you. In the upper left hand corner of the page select for role or warehouse, and the sidebar for database or schema respectively: