Snowflake SSO via Okta Fails Authentication in n8n

The key thing to note is that n8n's Snowflake credential configuration is based on a database connection authentication method that requires explicitly providing a username and password. This method is intended for service-to-service (non-interactive) connections where a valid password is expected.

On the other hand, SAML SSO using Okta (as documented in the SAML setup guides) is designed for managing user authentication to the n8n UI. It doesn't replace the database connection credentials needed by integration nodes like Snowflake.

Why the Error Occurs

• Snowflake Credentials: When you configure Snowflake credentials in n8n for running queries, the system expects a traditional set of connection parameters (account, database, warehouse, username, password, schema, and role).
• SSO with Okta: This SAML setup allows users to log in to the n8n UI without a traditional password, but it does not automatically provide a means for establishing a database connection to Snowflake.
• Authentication Error: Since the Snowflake node is trying to authenticate using a database connection and no valid password is provided (because the authentication was intended to be handled via SAML for the user interface), you receive the "username/password incorrect" error.

How to Resolve the Issue

1. Use Database Connection Credentials:
   For Snowflake nodes to function correctly in n8n, you need to create and use a Snowflake user account that has a valid password. Configure the node with those credentials so that a database connection can be established.

   • Ensure you provide all the required fields:
     • Account
     • Database
     • Warehouse
     • Username
     • Password
     • Schema
     • Role

2. Separate Concerns Between SSO and Node Credentials:
   Understand that SAML SSO with Okta applies to user authentication for accessing the n8n platform, not to the service/connection credentials used by nodes. If you require SSO for user management, continue using Okta for that purpose while maintaining separate traditional credentials for Snowflake integration.

3. Explore Alternative Authentication (If Needed):
   Verify with Snowflake if there is any alternative or token-based authentication method that might align with SSO-based workflows. If available, and supported by n8n, that could potentially bridge the gap. However, as of now, n8n’s Snowflake credentials require the standard username/password approach.

Summary

• The Snowflake credential configuration in n8n requires a traditional username and password.
• SAML SSO with Okta is used for n8n UI authentication and does not substitute the database connection credentials.
• To resolve the "username/password incorrect" error, use a dedicated Snowflake user account with a valid password in the node configuration.

By configuring the connection with proper Snowflake database credentials, your SQL queries should run without the authentication error.