“Incorrect username and password” when accessing Snowflake Database Instance configured with Client Credentials OAuth

Symptom

The connection fails with the following error messages. 

(Database error <5>: Connect failed. Error type: Odbc error. Odbc operation attempted: SQLDriverConnect. [28000:390100: on SQLHANDLE] Incorrect username or password was specified).

[ConnectionKeeper.cpp:85] Connect failed. Error type: Odbc error. Odbc operation attempted: SQLDriverConnect. [28000:390100: on SQLHANDLE] Incorrect username or password was specified. Connection String: DRIVER={SnowflakeDSIIDriver ODBC};SERVER=xxxx.snowflakecomputing.com;AUTHENTICATOR=oauth;WAREHOUSE=xxx;DATABASE=xxx;SCHEMA=xxx;UID=;. 

Cause

This issue occurs because the subject in the OAuth token does not match the user column value as defined in the Snowflake user mapping attribute.  

Solution

Verify that the sub (subject) value in the decoded OAuth token matches the value stored for the user column as defined in the Snowflake user‑mapping attribute. 
 

Steps:  
 
1. Prepare the cURL command to request the Access Token using the CC grant. For example, credentials of the client. 

Execute the command in the terminal using the following template: 

curl -X POST -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \ 
  --data-urlencode "client_id=<Client_ID>" \ 
  --data-urlencode "client_secret=<Client_Secret>" \ 
  --data-urlencode "grant_type=client_credentials" \ 
  --data-urlencode "scope=<Scope>/.default" \ 
'<Token_Endpoint>' 
 
After it runs successfully, you should see a response similar to the following. 
{ 

"token_type":"Bearer", 

"expires_in":3599, 

"ext_expires_in":3599, 

"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjVCM25SeHRRN2ppOGVORGMzRnkwNUtmOTdaRSIsIm.......FTU5nctRpmaA" 

} 
 
2. Decode the OAuth Access Token 

Copy the access_token value and decode it on an online decoder of your choice (for example, jwt.ms). It will provide the details in the token, similar to the response below: 
 
https://sts.windows.net/4c481368-xxxx-xxxx-xxxx-3844f846d0ca/", 

  "oid": "3d63d2ef-abb5-4029-bea5-c72c0652895d", 

  "rh": "1.AYIAaBNITGZFAUGcDDhE-EbQyi7MprcWchxIhpzKmCKYJ8CCAACCAA.", 

  "roles": [ 

    "session:role:ANALYST" 

  ], 

  "sub": "3d63d2ef-abb5-4029-bea5-c72c0652895d", 

  "tid": "4c481368-xxxx-xxxx-xxxx-3844f846d0ca", 

  "uti": "LcudwZszi06vgEbDZmqUAA", 

  "ver": "1.0" 

}.[Signature] 

3. In Snowflake, Verify the external_oauth_snowflake_user_mapping_attribute field in the  

Security Integration created in Snowflake: 
 
DESC Security Integration <security_integration_name>; 
 

4. Verify that a user exists in Snowflake with their LOGIN_NAME set as the “sub” value in step 2.  
 
Example: 
 
Because the `sub` value in the decoded access token from step 2 is `3d63d2ef-abb5-4029-bea5-c72c0652895d`, there must be a Snowflake user whose `LOGIN_NAME` is set to `3d63d2ef-abb5-4029-bea5-c72c0652895d`.