omar-massfih commented on PR #75810:
URL: https://github.com/apache/airflow/pull/75810#issuecomment-6449401807
Update: tested against a real Snowflake account.
**Setup:** an Azure Container Apps job with a user-assigned managed
identity, no stored secret, running this branch with
`snowflake-connector-python` 4.8.1. The connection used
`authenticator=WORKLOAD_IDENTITY` and `workload_identity_provider=AZURE`. The
Snowflake side was a `TYPE = SERVICE` user with `WORKLOAD_IDENTITY = (TYPE =
AZURE, ISSUER = ..., SUBJECT = <managed identity object id>)`.
**Result:** `SnowflakeSqlApiHook.get_headers()` returned
`X-Snowflake-Authorization-Token-Type: WORKLOAD_IDENTITY_FEDERATION`, and
`execute_query("select current_user(), current_role()", statement_count=1)` was
accepted by the SQL API. `wait_for_query` then reported `success`. So the SQL
API endpoint does accept `Bearer WIF.AZURE.<token>`, which the Snowflake docs
only implied.
**Observations:**
- One earlier run failed inside the connector's Azure attestation with
`Error fetching Azure metadata: ... localhost:12356 ... Read timed out (read
timeout=3)`, the connector's fixed 3 second timeout against the Container Apps
identity endpoint on a cold start. The next run passed on its first attempt, so
it looks like a cold-start flake in the connector rather than in this change,
but I only have one passing run so I can't call it reliable.
- Only the Azure path on Container Apps was exercised. AWS, GCP and OIDC are
still covered by unit tests only.
The test resources have been removed. Leaving this as a draft until
reviewers have had a look at the open questions in the description (the
connector-internal `wif_util` import and the version floor).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
