Snowflake Service User failed to connect with username and password

Snowflake is enforcing stronger authentication, database instance with standard login(username and password) would meet an error like "JdbcConnectionWrapper::Connect failed. Error type: Jdbc error. Jdbc operation attempted: Connect. [08001:390100: on SQLHANDLE] Incorrect username or password was specified. [a69b988b-4ad4-479f-8032-fb4f7adb7a6e]". Solution is to use Key-pair authentication, or Programmatic Access Tokens (or OAuth, depending on use case) or request a temporary extension of your account's enforcement date.

Symptom

Error message reported when user connects to Snowflake with basic authentication(user name and password):

JdbcConnectionWrapper::Connect failed. Error type: Jdbc error. Jdbc operation attempted: Connect. [08001:390100: on SQLHANDLE] Incorrect username or password was specified. [a69b988b-4ad4-479f-8032-fb4f7adb7a6e]

Cause

According to Snowflake https://docs.snowflake.com/en/user-guide/security-mfa-rollout

Phase 2: Strong authentication for new users

Phase 2 will be enforced in accounts on a rolling basis during a three-month period. You’ll receive a notification with the enforcement date for your account.

May 2026 - July 2026 [2]

Objective

New behavior

Mandatory MFA for all new human users

All human users that are created after this phase is enforced must use a second factor when authenticating with a password, including those using BI tools or similar.

Human users who existed before the phase is enforced are not affected. These password users can continue to use BI tools or similar (anything but Snowsight) without a second factor of authentication until the next phase.

For example, suppose this phase is enforced on May 15, 2026. All human users created on or after this date must use a second factor of authentication regardless of the surface. Human users who existed before this date can continue to use password-only authentication for BI tools, but not Snowsight.

No new legacy service users

All non-human users created after the phase is enforced must be of type SERVICE, which prevents them from using a password. The LEGACY_SERVICE type is no longer available when creating a new user object. In addition, administrators cannot change the type of an existing user to LEGACY_SERVICE.

For example, suppose this phase is enforced on May 15, 2026. After this date, TYPE=LEGACY_SERVICE is an invalid option when executing a CREATE USER or ALTER USER command.

Solution

Identify the application/integration still connecting as TPCH with a password (our logs show this is coming from your JDBC and ODBC clients) and reconfigure it to use key-pair authentication or a Programmatic Access Token.
If you need more time before completing the migration for all your automation and connections, you can request a temporary extension of your account's enforcement date yourself, without needing Snowflake Support:

This is intended as a temporary bridge to give your team time to finish updating the remaining connections — LEGACY_SERVICE is still a deprecated user type overall, so we'd recommend treating this as a short-term measure rather than a long-term fix, and continuing the migration to key-pair authentication, OAuth, or Programmatic Access Tokens for the affected service users.

Comment

0 comments

Details

Knowledge Article

Published:

September 20, 2026

Last Updated:

September 21, 2026

Symptom

Error message reported when user connects to Snowflake with basic authentication(user name and password):

Cause

Phase 2: Strong authentication for new users