When changing the Snowflake integration in Okta to use an AWS Privatelink or Azure Privatelink, the provisioning stops working, and the following error is received in Okta:

Error authenticating: null

• Snowflake
• Provisioning
• Provisioning error

The issue is caused by the current Okta provisioning not being supported over AWS Privatelink or Azure PrivateLink.

To use provisioning in conjunction with AWS Privatelink or Azure Privatelink for authentication, it is needed to have two separate applications for Snowflake in Okta. One application will be used for SSO (Authentication), and the second application for provisioning.

To create the second Snowflake application within Okta, the following steps are required:

Create the first Snowflake integration in Okta for authentication (SSO/SAML)

1. Create a SAML Snowflake application in Okta for SSO:
   1. Set up a new SAML integration using "account.snowflakeregion.privatelink or organization-accountname.privatelink" for the subdomain value.
   2. Move to the Sign On tab, and in the Setting section, select SAML 2.0.
   3. Click the View Setup Instructions button (this will open a new tab web browser tab with the information necessary to configure the Snowflake side).

Create the second Snowflake integration (Provisioning)

1. Change from account.snowflakeregion.privatelink or organization-accountname.privatelink to account.snowflakeregion or organization-accountname (Note .privatelink is not a part of the subdomain).
2. Switch to the Sign On tab and select Secure Web Authentication and the desired username and password format.
3. Set the second application for provisioning as usual.

NOTE:

• If creating the second Snowflake integration in Okta is not desired, and AWS Privatelink or Azure PrivateLink is used to access Snowflake, ensure the PrivateLink URL is not used in the integration settings (subdomain section in Okta).
• Enter the public endpoint (without .privatelink) and ensure that the network policy allows access from Okta IP addresses. Otherwise, the SCIM integration (provisioning) will not work.
   

Related References

• Allow access to Okta IP addresses
• How to Configure Okta SCIM Provisioning if using AWS or Azure PrivateLink with a Snowflake Account
• How To: Setup SSO Using Okta with Snowflake new URL format OR Privatelink