Add externalbrowser authentication for SSO Snowflake users
- Dominant language
- Rust
- Stars
- 20.8k
- Forks
- 2.1k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 181
Description
When attempting to configure the Cube.js Snowflake database driver to use the externalbrowser authenticator (CUBEJS_DB_SNOWFLAKE_AUTHENTICATOR=externalbrowser), the schema introspection process fails.
The specific error encountered is ClientError: connect() does not work with external browser or okta authenticators, call connectAsync() instead. This indicates that a synchronous connection method is being called by the driver during schema loading, which is incompatible with the asynchronous, browser-based authentication flow required by externalbrowser.
This issue prevents developers from using Cube.js with Snowflake accounts where externalbrowser authentication is required for security reasons (e.g., mandated SSO/MFA policies), making schema loading and local development challenging or impossible with this common authentication method.
The Cube.js Snowflake driver (@cubejs-backend/snowflake-driver) should fully support the externalbrowser authenticator for all necessary operations, including schema introspection. The driver should internally use the connectAsync() method (or equivalent asynchronous logic) where required by the snowflake-sdk for this authenticator type.
This would allow users to configure Cube.js with CUBEJS_DB_SNOWFLAKE_AUTHENTICATOR=externalbrowser, have the browser flow initiated correctly during schema loading, and successfully connect to introspect the database schema.

Contributor guide
Assessment
This issue has not been assessed yet.