​

Snowflake Integration Setup

Honeydew is built on top of Snowflake and requires access to Snowflake in order to operate. You have two options to set up Snowflake access - either using a central org-level connection parameters or map your individual Snowflake user credentials to Honeydew.

If you would like to use a central org-level connection, it is advised to create a new dedicated Snowflake user for Honeydew integration. The following Snowflake connection parameters are required for Honeydew setup:

1. Account name
2. Username
3. Role
4. Warehouse

​

Authentication Methods

Honeydew supports the following authentication methods for Snowflake:

​

Key-pair authentication

This is the recommended method for org-level service accounts. For this method, you will need to provide a Private Key and possibly a Private Key Passphrase (if used).

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

ssh-keygen -t rsa -b 2048 -m pkcs8 -f %userprofile%\rsa_key.p8

ssh-keygen -e -f %userprofile%\rsa_key.p8.pub -m pkcs8 > %userprofile%\rsa_key.pub

 -- Replace <HONEYDEW_USER> with the Snowflake user name and <PUBLIC_KEY> with the content of the rsa_key.pub file
ALTER USER <HONEYDEW_USER> SET RSA_PUBLIC_KEY='<PUBLIC_KEY>';

​

OAuth authentication

This is the recommended method for individual users credentials. Each user will need to connect to Honeydew using their own Snowflake OAuth credentials. For this method, you will need to create a new Snowflake OAuth integration and then provide a Client ID and Client Secret.

When Snowflake OAuth is used, users can authorize their Honeydew credentials using SSO via Snowflake. If Snowflake is set up with SSO through a third-party identity provider, Honeydew users can use this method to log into Snowflake and authorize Honeydew credentials without any additional setup.

​

OAuth integration configuration

https://api.honeydew.cloud/oauth2callback

CREATE OR REPLACE SECURITY INTEGRATION HONEYDEW_OAUTH_INTEGRATION   -- Replace HONEYDEW_OAUTH_INTEGRATION with your desired integration name
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = '<REDIRECT_URI>'                 -- Replace with the Honeydew redirect URI
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = <VALIDITY_IN_SECONDS>  -- Replace with desired validity period in seconds
  PRE_AUTHORIZED_ROLES_LIST = ( '<role_name1>', ...)    -- Replace with the list of roles that will be used for OAuth authentication
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT;                 -- Required for secondary roles

WITH
OAUTH_SECRETS as (
  select PARSE_JSON(
    system$SHOW_OAUTH_CLIENT_SECRETS('HONEYDEW_OAUTH_INTEGRATION')) as SECRETS_JSON     -- Replace HONEYDEW_OAUTH_INTEGRATION with your integration name
)
SELECT
  SECRETS_JSON:"OAUTH_CLIENT_ID"::string as CLIENT_ID,
  SECRETS_JSON:"OAUTH_CLIENT_SECRET"::string as CLIENT_SECRET
from
  OAUTH_SECRETS;

​

User setup

Once Snowflake OAuth integration is configured, Honeydew users will be able to provide their credentials via OAuth. By clicking “Connect to Snowflake” in the Snowflake settings, users will be redirected to Snowflake to authorize with the configured SSO provider.

​

PAT (programmatic access tokens) authentication

For this method, you will need to provide a generated access token.

​

Password authentication

For this method, you will need to provide a password, and will likely be required to approve access via MFA.

The following Snowflake connection parameters are required to be able to deploy dynamic datasets to Snowflake:

1. Database - the database where Honeydew will deploy any dynamic datasets as views or tables
2. Schema - the schema where Honeydew will deploy any dynamic datasets as views or tables
3. Dev Database - the database where Honeydew will deploy any dynamic datasets as views or tables when working on a dev branch
4. Dev Schema - the schema where Honeydew will deploy any dynamic datasets as views or tables when working on a dev branch

​

Allowing Honeydew client IP addresses

If you have IP-based access restrictions in Snowflake, add the IP addresses displayed in the Snowflake connection screen in Honeydew App settings page to the “Allowed IP Addresses” list.

​

Permissions

Honeydew does not process any Snowflake data, but only reads metadata and deploys views/tables. You can find more security-related information here.

If using an integration user deployment, the Honeydew integration user/role require the following permissions to operate:

1. USAGE on any databases and schemas which will be used as part of the semantic layer
2. SELECT on any tables/views which will be used as part of the semantic layer
3. CREATE TABLE, CREATE DYNAMIC TABLE and CREATE VIEW on the database/schema where dynamic datasets will be deployed

-- Grant the SNOWFLAKE.CORTEX_USER role to the user role created for Honeydew integration
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE HONEYDEW_USER_ROLE;