SNOW-1367369: Allow passing passcode for DUO MFA

[mcastany]

What is the current behavior?

I cannot configure the SDK with passcode and I'm spamming DUO push notifications to my device everytime I want to execute a script

What is the desired behavior?

I can setup my DUO mfa passcode and be able to connect to Snowflake without a push notification

[sfc-gh-dszmolka]

hi - I know the current behaviour is mildly annoying .. fortunately, the works are already in progress to add MFA caching capability for this driver too. Tracking issue is #493, I recommend subscribing to those updates.

After the capability is implemented and a new driver version is released on top of the (future) merged PR, you won't need to spam and be spammed by DUO notifications after enabling the MFA caching feature on the server-side and driver side too. (server-side already supports this, however the snowflake-sdk driver not yet)

Hope this answers your question - also would like to recommend closing this issue and following the other one linked here.

[mcastany]

@sfc-gh-dszmolka TBH, I don't mind the spam that much, but the other day my account got locked. Do you know if there's any limit of push notifications from Duo?

[sfc-gh-dszmolka]

this is two independent things. For one, your Snowflake user will get locked temporarily, regardless of the authentication method and MFA/no MFA, if there are too many unsuccessful login attempts. This temporal lock should also disappear on its own after 15 minutes.

For the rate limit on the DUO authentication API, that's not managed by Snowflake but they probably have a rate limit. It should be transparent to the Snowflake user.

Hope this clarifies but please let me know if you have any other questions. Otherwise, I suggest closing this duplicate issue and following the linked one for the feature implementation.