Skip to content

Conversation

@Vishalup29
Copy link
Contributor

Description

This PR adds support for passing an optional OAuth scope parameter when using the
client_credentials grant type in SnowflakeHook.get_oauth_token.

Many identity providers (Okta, Auth0, Azure AD, corporate IdPs) require or recommend including a scope
in client-credential OAuth exchanges. Currently, Airflow cannot send a scope value, forcing users to
apply custom patches or weaken their IdP requirements.

This PR introduces an optional extra field on the Snowflake connection:

extra: {"oauth_scope": "your-scope-value"}

less
Copy code

When present and the grant_type is client_credentials, the hook will send:

scope=

markdown
Copy code

in the POST body to the token endpoint.
If no scope is provided, the existing behavior is unchanged.

Tests

This PR updates the OAuth unit tests to validate:

  • Scope is not included for refresh token grant (existing behavior unchanged)
  • Scope is included when:
    • grant_type=client_credentials
    • oauth_scope is provided
  • Scope is omitted when the field is empty or not provided
  • Existing OAuth tests continue to pass untouched

Cross-provider compatibility

This matches patterns already used in Azure OAuth (azure_oauth_scope).

Related Issue

Closes #58815

@Vishalup29 Vishalup29 requested a review from potiuk as a code owner November 30, 2025 06:30
@boring-cyborg boring-cyborg bot added area:providers provider:snowflake Issues related to Snowflake provider labels Nov 30, 2025
@boring-cyborg
Copy link

boring-cyborg bot commented Nov 30, 2025

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

  • Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
  • In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
  • Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
  • Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
  • Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
  • Be sure to read the Airflow Coding style.
  • Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
    Apache Airflow is a community-driven project and together we are making it better 🚀.
    In case of doubts contact the developers at:
    Mailing List: dev@airflow.apache.org
    Slack: https://s.apache.org/airflow-slack

@potiuk
Copy link
Member

potiuk commented Dec 1, 2025

Already merged in #58815

@potiuk potiuk closed this Dec 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:providers provider:snowflake Issues related to Snowflake provider

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support passing an OAuth scope parameter in Snowflake client_credentials flow

2 participants