A company wants to Integrate its main enterprise identity provider with federated authentication with Snowflake. The authentication integration has been configured and roles have been created in…

Question

Options

• AOAuth must be configured between the identity provider and Snowflake. Then the authorization
• BOAuth must be configured between the identity provider and Snowflake. Then the authorization
• CSCIM must be enabled between the identity provider and Snowflake. Once both are synchronized
• DSCIM must be enabled between the identity provider and Snowflake. Once both are synchronized

• A
  5% (2)
• B
  7% (3)
• C
  14% (6)
• D
  75% (33)

Explanation

The problem describes two missing capabilities: (1) automatic user provisioning (users not appearing in Snowflake when created in the IdP) and (2) automatic role assignment based on group membership. Federated authentication (SAML/SSO) alone handles login but does NOT provision users or sync groups - it only authenticates users who already exist in Snowflake. SCIM (System for Cross-domain Identity Management) is the protocol that solves both problems: it enables the IdP to automatically push user creation, updates, deactivation, and group membership changes to Snowflake in real time. Choice D is correct because it specifies SCIM enablement AND addresses that group memberships are reflected in Snowflake roles, which SCIM accomplishes by mapping IdP groups to Snowflake roles. Choice C is similar but likely differs in a key detail (e.g., manual role mapping vs. automatic sync). OAuth (Choices A and B) is an authorization delegation protocol for third-party application access - it does not handle user provisioning or group sync, making it the wrong solution for this use case.

No community discussion yet for this question.