Snowflake SCIM provisioning from Google Workspace

Snowflake ships SCIM connectors for Okta and Microsoft Entra ID, and a custom SCIM integration for every other identity provider, including Google Workspace through AnySCIM. You create the integration with a few SQL statements, generate a SCIM access token, and AnySCIM uses it with https://{account_identifier}.snowflakecomputing.com/scim/v2 to create Snowflake users, sync Google groups as Snowflake roles and disable people who leave.

Requirements

• The ACCOUNTADMIN role in Snowflake, to create the integration and the provisioning role.
• Your account identifier, the first part of your Snowflake URL (<account_identifier>.snowflakecomputing.com). If it contains underscores, use the hyphenated form.
• A Google Workspace source already connected. See Connect Google Workspace.

Create the SCIM integration and token

Run these statements in a worksheet:

use role accountadmin;

create role if not exists generic_scim_provisioner;
grant create user on account to role generic_scim_provisioner;
grant create role on account to role generic_scim_provisioner;
grant role generic_scim_provisioner to role accountadmin;

create or replace security integration generic_scim_provisioning
  type = scim
  scim_client = 'generic'
  run_as_role = 'GENERIC_SCIM_PROVISIONER';

select system$generate_scim_access_token('GENERIC_SCIM_PROVISIONING');

Copy the value returned by the last statement. Users and roles created through SCIM are owned by GENERIC_SCIM_PROVISIONER.

Connect Snowflake in AnySCIM

1. Open Connections → New connection and choose Snowflake.
2. Replace {account_identifier} in the base URL with your account identifier, paste the token and click Test connection.
3. In Scope, select the people who should have Snowflake, for example your data and analytics groups. Turn on Push group membership to create a Snowflake role for each Google group.
4. Review the dry-run and activate.

How users are synced

• New users in scope are created in Snowflake with their Google email as the user name and login name, and their full name as the display name.
• AnySCIM looks users up with userName eq, the only filter Snowflake's SCIM API supports.
• When a Google user is suspended, AnySCIM sets active: false, which sets DISABLED = TRUE on the Snowflake user.
• Each Google group becomes a Snowflake role with the same name, and its members are granted that role. Nested Google groups are expanded first. Grant privileges to these roles in Snowflake as usual: AnySCIM manages who has the role, not what the role can do.
• AnySCIM doesn't send passwords. Users sign in through SSO, which you enable separately in Snowflake.

Troubleshooting

• 401 after months of working: the six-month token expired. Generate a new one and update the connection.
• Errors when changing roles: the provisioning role must own the roles it manages. Don't change the owner of SCIM-created roles, or use a role with MANAGE GRANTS as run_as_role.
• Requests blocked by a network policy: a network policy set on the SCIM integration overrides the account-level one. Set one with alter security integration generic_scim_provisioning set network_policy = <policy> that allows AnySCIM's servers.
• Changes made in Snowflake are overwritten: edits made directly in Snowflake are not synced back to Google Workspace. Make changes in Google and let the next sync apply them.

FAQ

Does Snowflake support SCIM with Google Workspace?

Snowflake has no built-in Google Workspace connector, but its custom SCIM integration (scim_client = 'generic') works with any SCIM client. AnySCIM connects Google Workspace to it.

Do Google groups become Snowflake roles?

Yes. With Push group membership enabled, each Google group becomes a Snowflake role of the same name and its members are granted it. You then grant privileges to that role in Snowflake.

How long does the Snowflake SCIM token last?

Six months. Generate a new one with system$generate_scim_access_token('GENERIC_SCIM_PROVISIONING') and update the AnySCIM connection before it expires.