Configure Snowflake Key-Pair Authentication

Introduction

Angles Hub supports key-pair authentication for Snowflake connections, providing a secure and reliable way to connect to Snowflake. Key-pair authentication uses a private key file and its passphrase to establish the connection.

Prerequisites

Before configuring key-pair authentication, ensure the following:

• Install OpenSSL on the machine where you'll generate the key-pair before you start.
• A Snowflake user account is set up and accessible.

• Contact your Snowflake administrator to register a public key for the target user.

Set Up Key-Pair Authentication

To set up key-pair authentication between Angles Hub and Snowflake, complete the following steps.

1. Generate the Private Key

2. Generate the Public Key

3. Register the Public Key in Snowflake

4. Update the Connection in Angles Hub

Step 1: Generate the Private Key

1. Open Command Prompt and navigate to the folder where the key files will be stored.

2. Run the following command to generate an encrypted private key:

   openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

   Note: rsa_key is the default file name. Replace it with any name of your choice.

3. When prompted, enter a passphrase to encrypt the private key.

   Note: Store the passphrase securely. It is required when configuring the Snowflake connection in Angles Hub.

Step 2: Generate the Public Key

In the same Command Prompt session, run the following command to generate the public key from the private key:

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

This produces two files:

• rsa_key.p8 — Private key (store securely)
• rsa_key.pub — Public key (to be registered in Snowflake)

Step 3: Register the Public Key in Snowflake

1. Open the generated public key file (rsa_key.pub) in a text editor such as Notepad++.

2. Copy the full contents of the file.

3. Run the following command in your Snowflake environment or SQL developer tool:

   ALTER USER <snowflake_user> SET RSA_PUBLIC_KEY='<public_key_value>';

   • Replace <snowflake_user> with the Snowflake username used in Angles Hub.
   • Replace <public_key_value> with the copied contents of the public key file.

   Important: The public key must be registered for the same Snowflake user that is entered in the Username field in Angles Hub. This is a one-time setup unless keys are rotated.

Step 4: Update the Connection in Angles Hub

Note: Ensure that you remove any previously configured Snowflake connections.

1. In Angles Hub, navigate to the connection configuration and create a new Snowflake connection.

2. Enter the following parameters:

   1. Username

   2. Server / Host

   3. Port

   4. Account

   5. Database

   6. Warehouse

3. In the Private Key File field, enter the full path to the rsa_key.p8 file on your machine.

4. In the Private Key Passphrase field, enter the passphrase you set during key generation.

5. Save the connection configuration.

Best Practices

• Store the private key file in a restricted location and limit file system access to authorized users only.

• RSA private/public keys don't have a built-in expiration date. They stay valid until you replace or remove them.

• Rotate the keys periodically (for example, every 90 to 365 days) as a security best practice.

• Share the private key only through secure, encrypted channels. Never send it over email or unsecured connections.

• Protect the private key with a strong passphrase.

• Register the public key only for the intended Snowflake user.