embucket-labs icon indicating copy to clipboard operation
embucket-labs copied to clipboard

v1 rest (snowflake): Session dropped after restart of the binary

Open DanCodedThis opened this issue 5 months ago • 1 comments

Problem

  • If you use snowflake cli, if you restart the binary you need to relogin (restart the cli), since session are only in-memory
  • Snowflake docs about this: https://docs.snowflake.com/en/user-guide/authentication-policies#security-policy-precedence
  • Their timeout is by default 4 hours of inactivity (ours is 5 mins), if you query you will renew inactivity with now + inactivity timeout (works the same)

Solutions:

  • Use JWT (format may become incorrect in the future)
  • Keep the session id in SlateDB (later will be able to set session parameters there, like Timezone for example)

cc @osipovartem can provide more info

DanCodedThis avatar Jul 08 '25 16:07 DanCodedThis

@DanCodedThis Since we have another programmatic API that will also require a authentication (namely, Iceberg catalog REST API), it would be interesting to explore if we can unify it with snowflake (and perhaps deviate a little from what we have right now).

Iceberg REST API spec currently supports OAuth2 (see reference implementation in lakekeeper/lakekeeper, for example), however I distantly remember, next standard might change authentication approach.

Had we decide to go this way, it basically aligns with the 1st solution. I also a bit hesitant to hit db (slatedb in our case) for each request.

rampage644 avatar Jul 08 '25 18:07 rampage644