Okta SAML SSO Fails from Tableau to Snowflake with Destination URL Mismatch

Tableau fails to connect to Snowflake via Okta Security Assertion Markup Language (SAML) Single Sign-On (SSO) because a device posture policy triggers a silent device probe that breaks the authentication flow. Administrators must migrate the integration to OAuth or create a policy exemption in Okta to resolve the connection failure. Users experience a connection failure when authenticating from Tableau Desktop on Windows or Tableau Web to Snowflake. The Okta System Log shows successful primary authentication but lacks the expected policy.evaluate_sign_on or Snowflake SSO events. Tableau displays generic error B19090E0 followed by a specific Snowflake Open Database Connectivity (ODBC) error.

[Snowflake][Snowflake] (35) The specified authenticator and destination URL in Saml Assertion did not match.

This issue typically starts occurring after the Snowflake application in Okta moves to a stricter App Sign-On policy.

• Okta Identity Engine (OIE)
• Snowflake
• Tableau Desktop
• Tableau Cloud
• Tableau Web
• App Sign-On Policies

The Snowflake application belongs to an App Sign-On policy containing a rule that requires Device Posture. Enforcing device context requires Okta to send a silent device probe via an Okta Verify loopback link before the policy evaluation completes. This probe breaks the SAML flow in two ways depending on the client.

• Tableau Web (Cloud): The authentication request originates from the Tableau Cloud backend Software as a Service (SaaS) servers rather than the local machine. The server cannot answer a local Okta Verify device challenge, causing the flow to drop silently with a 400 Bad Request.
• Tableau Desktop (Windows): The embedded browser in Tableau fails to process the loopback probe, or the complex redirect sequence alters the final localhost callback URL. The Snowflake ODBC driver strictly compares the callback URL to the Destination attribute inside the SAML assertion. Because the Okta redirects alter the URL, the driver registers a mismatch and throws Error 35.

NOTE: Tableau Desktop on macOS generally remains unaffected because newer Mac Snowflake ODBC drivers handle the Okta loopback redirects without causing a SAML Destination mismatch.

Migrate the integration to OAuth.

OAuth natively handles modern device posture redirects and loopback checks without breaking the authentication flow. Reconfigure the Snowflake data source connections within Tableau and configure the Snowflake OAuth settings to trust Okta as the Authorization Server by following these steps.

1. Reconfigure the Snowflake data source connections within Tableau to use OAuth instead of the SAML Identity Provider (IdP).
2. Configure the corresponding Snowflake OAuth settings to trust Okta as the Authorization Server.

How does a policy exemption bypass the device posture requirement?

SAML remains fundamentally incompatible with the device probe in this specific client architecture. Bypass the Device Posture requirement specifically for these authentication flows by creating a new rule or editing an existing relaxed rule in the Okta Admin Console. Navigate to the Authentication Policies, create a relaxed rule that allows access without requiring a registered device, and place the rule at a higher priority by following these steps.

1. Navigate to Security and select Authentication Policies.
2. Select the Snowflake App Sign-On Policy.
3. Create a new rule or edit an existing relaxed rule.
4. Configure the rule to allow access and explicitly not require a registered or managed device.
5. Scope this relaxed rule specifically to the known IP zones used by the Tableau Cloud environment if restricting Tableau Web.
6. Save the policy and ensure Okta evaluates this relaxed rule at a higher priority than any device-enforced rules.