Lighdash Preview: Snowflake MFA (Duo Push) not currently cached

[gordonkjlee]

Description

When in lightdash preview, every action that sends a request to Snowflake results in a Duo Push MFA request - e.g. filter autocomplete, query run, etc. This is not user-friendly, but can be solved if MFA is cached in the jdbc string(?).

https://docs.snowflake.com/en/user-guide/security-mfa.html#using-mfa-token-caching-to-minimize-the-number-of-prompts-during-authentication-optional

What problem does this solve?

Makes Lightdash Preview more usable

[stale]

Is this issue still relevant? There have been no updates for 60 days, please close the issue or keep the conversation going!

[gordonkjlee]

Multiple Duo Push MFA requests are also triggered in the Lightdash app - e.g. if a Dev project is being used and connecting to a Dev database in Snowflake using a user's dev user credentials that is secured by MFA. This is very non-user friendly and risks the user being locked out of Snowflake if a Duo Push is missed on the user's device.

[TuringLovesDeathMetal]

Here's how dbt handles it: https://docs.getdbt.com/docs/core/connect-data-platform/snowflake-setup#user--password--duo-mfa-authentication

I wonder if we can add this authenticator bit as an extra parameter in the Snowflake data warehouse settings?

[owlas]

According to the Snowflake docs, it looks like this isn't currently supported for the node.js SDK that we require:

• https://docs.snowflake.com/en/user-guide/security-mfa#using-mfa-token-caching-to-minimize-the-number-of-prompts-during-authentication-optional
• Add support for MFA token caching snowflakedb/snowflake-connector-nodejs#493

I believe the only reason that we reach out to snowflake for each explore is to get the INFORMATION_SCHEMA for the table so that we can figure out the dimension types. We could remove this if all the columns already have a dimension.type set

[ZeRego]

@owlas could we also have an option to skip that part eg: --skip-warehouse-catalog

[jonathankkizer]

Curious if this can be reprioritized, once snowflakedb/snowflake-connector-nodejs#493 is complete — looks like active progress, and though they’ve missed an ETA, hopeful that it is available in the next few months (I’ve asked for an updated ETA)