Snowflake PowerBI SSO works only a short time after creating the security integration

0
votes

i am currently trying to make Snowflake PowerBI Integration via Azure AD SSO work. What i have done so far: Followed the Tutorial to create the Azure AD Enterprise Application: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/snowflake-tutorial#adding-snowflake-from-the-gallery Asked one of my colleagues to enable Snowflake SSO in our PowerBI Tenant: https://docs.microsoft.com/en-us/power-bi/connect-data/service-connect-snowflake Created the security integration as described here: https://docs.snowflake.com/en/user-guide/oauth-powerbi.html

After running this query:

create security integration powerbi
type = external_oauth
enabled = true
external_oauth_type = azure
external_oauth_issuer = '<AZURE_AD_ISSUER>'
external_oauth_jws_keys_url = 'https://login.windows.net/common/discovery/keys'
external_oauth_audience_list = ('https://analysis.windows.net/powerbi/connector/Snowflake')
external_oauth_token_user_mapping_claim = 'upn'
external_oauth_snowflake_user_mapping_attribute = 'login_name';

Everything works like a charm for a few minutes. However after some minutes when refreshing or re-opening a PowerBI project i get:

ODBC: ERROR [28000] Invalid OAuth access token.

When re-running the above SQL to generate the security integration it works again for a few minutes.

Any ideas on what might be going on or how to investigate the issue further?

Thank you for your thoughts

1
azure-active-directorypowerbisingle-sign-onsnowflake-cloud-data-platformpowerbi-desktop
It sounds like your token is expiring. Snowflake documentation recommends you check, In Azure AD, verify the access token is current. – Mike Walton
Hm, i think that refers to the SAML Access token set for SAML authentication here: docs.microsoft.com/en-us/azure/active-directory/saas-apps/…? I have never changed that since initial setup. The weird thing is is just rerun the statement to create the exact same security integration and PowerBI connector works again for a few minutes. – Lutz K.

1 Answers

1
votes

This value needs to be set: external_oauth_issuer = '<AZURE_AD_ISSUER>'

In general, we have some documentation on error messages with PowerBI OAuth which may be helpful: https://docs.snowflake.com/en/user-guide/oauth-powerbi.html#error-messages