Snowflake: Support passing OAuth scope parameter in client_credentials flow #58863
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds support for passing an optional OAuth
scopeparameter when using theclient_credentialsgrant type inSnowflakeHook.get_oauth_token.Many identity providers (Okta, Auth0, Azure AD, corporate IdPs) require or recommend including a scope
in client-credential OAuth exchanges. Currently, Airflow cannot send a scope value, forcing users to
apply custom patches or weaken their IdP requirements.
This PR introduces an optional extra field on the Snowflake connection:
extra: {"oauth_scope": "your-scope-value"}
less
Copy code
When present and the
grant_typeisclient_credentials, the hook will send:scope=
markdown
Copy code
in the POST body to the token endpoint.
If no scope is provided, the existing behavior is unchanged.
Tests
This PR updates the OAuth unit tests to validate:
grant_type=client_credentialsoauth_scopeis providedCross-provider compatibility
This matches patterns already used in Azure OAuth (
azure_oauth_scope).Related Issue
Closes #58815