Configure Snowflake for AI agent imports

To import AI agents from Snowflake, you need to perform configuration tasks in your Snowflake account.

About this task

Configuring Snowflake for AI agent imports requires setup in your Snowflake account. In Snowflake, you create a custom role with access to the agents that you want to import, grant the role to the user who authorizes the connection, create an OAuth security integration, and then retrieve the client credentials. Okta uses these credentials to authenticate requests to the Snowflake REST and SQL APIs.

Okta imports Cortex Agents, which are Snowflake-managed agents scoped to a database and schema.

Before you begin

You have the ACCOUNTADMIN role in Snowflake, or a role with the global CREATE INTEGRATION privilege.
You have the SECURITYADMIN role in Snowflake, or an equivalent role that can create and grant roles.
You have the permission to manage apps in Okta.
You have integrated the Snowflake app in your org and entered your Snowflake account subdomain on the General tab. See Add app integrations.

Important:

Snowflake doesn't allow ACCOUNTADMIN, SECURITYADMIN, GLOBALORGADMIN, or ORGADMIN as the session role for an OAuth connection. You must create a dedicated custom role for the import.

Procedure

Create a custom role in Snowflake

Sign in to Snowsight with the SECURITYADMIN role.
Run the following SQL to create the custom role and grant it access to a database and schema:
```
USE ROLE SECURITYADMIN;
CREATE ROLE IF NOT EXISTS OKTA_AI_AGENT_IMPORT_ROLE;
GRANT USAGE ON DATABASE <your_database> TO ROLE OKTA_AI_AGENT_IMPORT_ROLE;
GRANT USAGE ON SCHEMA <your_database>.<your_schema> TO ROLE OKTA_AI_AGENT_IMPORT_ROLE;
```
Repeat the GRANT USAGE statements for every database and schema that you want to import from. The role can only access the databases, schemas, and agents that you explicitly grant.

Run the following SQL to grant the role access to the Cortex Agents in the schema:

GRANT USAGE ON ALL AGENTS IN SCHEMA <your_database>.<your_schema> TO ROLE OKTA_AI_AGENT_IMPORT_ROLE;
GRANT USAGE ON FUTURE AGENTS IN SCHEMA <your_database>.<your_schema> TO ROLE OKTA_AI_AGENT_IMPORT_ROLE;

Grant the role to the authorizing user

Choose the Snowflake user who authorizes the connection with Okta.
Okta doesn't request a specific role by name. The user's session starts in their default role, and then switches to the custom role for import requests.

Run the following SQL to grant the custom role to the user:

USE ROLE SECURITYADMIN;
GRANT ROLE OKTA_AI_AGENT_IMPORT_ROLE TO USER <authorizing_user>;

Optional. To set the custom role as the user's default role, run the following SQL:
```
ALTER USER <authorizing_user> SET DEFAULT_ROLE = OKTA_AI_AGENT_IMPORT_ROLE;
```

Create an OAuth security integration in Snowflake

Run the following SQL to create the security integration. Replace <your_okta_domain> with your Okta org domain (for example, example.okta.com).
```
USE ROLE ACCOUNTADMIN;
CREATE SECURITY INTEGRATION OKTA_AI_AGENT_IMPORT_OAUTH
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://<your_okta_domain>/oauth2/v1/sts/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  OAUTH_ANY_ROLE_MODE = 'ENABLE'
  ALLOWED_ROLES_LIST = ('OKTA_AI_AGENT_IMPORT_ROLE');
```
OAUTH_ANY_ROLE_MODE = 'ENABLE' is required because Okta requests the session:role-any scope. ALLOWED_ROLES_LIST limits the session to the custom role.

Important:
Set OAUTH_ISSUE_REFRESH_TOKENS to TRUE and use the longest OAUTH_REFRESH_TOKEN_VALIDITY that your security policy allows. The example value is 90 days. If Snowflake doesn't issue refresh tokens, imports fail after the first access token expires.

Run the following SQL to retrieve the client ID and client secret:

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('OKTA_AI_AGENT_IMPORT_OAUTH');

Copy the client ID and client secret and store them in a secure location.

Note:
You can't retrieve the client secret again after you close this session.
Optional. To verify the integration, run DESC SECURITY INTEGRATION OKTA_AI_AGENT_IMPORT_OAUTH;.
In the output, OAUTH_ALLOWED_AUTHORIZATION_ENDPOINTS is https://<your_account>.snowflakecomputing.com/oauth/authorize, and OAUTH_ALLOWED_TOKEN_ENDPOINTS is https://<your_account>.snowflakecomputing.com/oauth/token-request.
Record the client ID, client secret, and any database and schema pairs that you want to import from.
When you configure the AI agent import in Okta, enter the client ID in Client ID, the client secret in Client Secret, and select Cortex Agents in Platform. To limit the import, enter DATABASE.SCHEMA pairs (for example, SALES_DB.PUBLIC) in Import Scopes. When you select Test API Credentials, sign in as the authorizing user.