ADF Snowflake Connector - Key pair authentication - Failed to parse PEM block containing the private key.

Md, Muzaffar 20

I have created RSA key pair for my snowflake service account.

I tested authenticating snowflake with this RSA keys in python. Data from snowflake loaded successfully.

Now I'm trying to use this RSA private key for authentication in ADF.

I have followed step by step procedure from this documentation.

https://learn.microsoft.com/en-us/azure/data-factory/connector-snowflake?tabs=data-factory#key-pair-authentication

But my Privatekey is not working in the snowflake connector.

Added newline characters (\n) to each line in the privatekey file as per above documentation DC1U4[1]
This is my private key

While addign this private key in linked service getting this error - Failed to parse PEM block containing the private key.

IDQ99[1]

Tried in all the ways like - adding newline char (\n), removing newline char, removing header (-----BEGIN PRIVATE KEY-----) & footer (-----END PRIVATE KEY-----) of private key.. nothing worked.

I have checked for special characters in my key. I have these three special characters + / = in my key.

Can anyone please help me on this.

BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee

2024-04-22T21:23:40.0666667+00:00

Hello Md, Muzaffar,

Welcome to the Microsoft Q&A forum.

Please check if you are using the account name along with its organization.

For example, myorg-account123.

https://learn.microsoft.com/en-us/azure/data-factory/connector-snowflake?tabs=data-factory#linked-service-properties
Md, Muzaffar 20 Reputation points

2024-04-23T02:43:08.93+00:00

Hi @BhargavaGunnam-MSFT

For Basic authentication I used accountIdentifier = ecolab.east-us-2.azure
This worked for basic authentication.

As per your comment, For Key pair Authentication I tried with -

ecolab.east-us-2.azure

ecolab.east-us-2.azure-svc-cds-3d-fsi-np@ecolab.com

ecolab.east-us-2.azure-svc-cds-3d-fsi-np

ecolab.east-us-2-svc-cds-3d-fsi-np@ecolab.com

ecolab.east-us-2.svc-cds-3d-fsi-np@ecolab.com
ecolab-svc-cds-3d-fsi-np@ecolab.com

ecolab-svc-cds-3d-fsi-np

I'm same error for all the Account Identifiers

Not sure if any issue with format of primary key
BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee

2024-04-23T15:45:28.27+00:00

Could you try use Azure Key Vault to store the privateKey and use keyPair auth?

Customer can upload privateKey file to azure keyVault by "az keyvault secret set --vault-name <vaultName>--name <secretName> --file <privateKeyFilePath>" and use key vault stored privateKey to connect with snowflake database.

If the above doesn't work- then please try edit linked service json.

another work around is to see if the connection was successful using Key Pair config via ODBC

You can follow the below document.

https://community.snowflake.com/s/article/How-to-set-up-ODBC-Driver-with-key-pair-authentication-to-connect-to-Snowflake-on-Windows
Md, Muzaffar 20 Reputation points

2024-04-23T15:54:09.7533333+00:00

Uploaded the private key into key vault using CLI. Now getting this error - JWT token is invalid
BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee

2024-04-23T16:39:19.88+00:00

it looks like the value seems to be incorrect

Below is the sample privateKey format and make sure the privateKey value is like this without quotation and each one-line privateKey string with "\n".
Md, Muzaffar 20 Reputation points

2024-04-23T17:42:02.16+00:00

Yes used CLI to upload the key file.

I uploaded original private key in CLI and it showed \n for each newline like this.

But if we check the keyvault there is newline in the key instead of \n. (understood the usage of CLI here)

but now i’m getting this error - JWT token is invalid.

Need to confirm with my account name : ecolab.east-us-2.azure

This is working for Basic Authentication. Not sure the same will work for key pair authentication or we need to change it.
BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee

2024-04-23T17:53:14.7566667+00:00

Md, Muzaffar

Can you also change the account name along with organization?
Md, Muzaffar 20 Reputation points

2024-04-24T04:46:03.3133333+00:00

Thank you @BhargavaGunnam-MSFT
Changed account name to GL57635-ECOLAB

This worked. The connection is successful.
account name : ecolab.east-us-2.azure worked for only Basic Authentication
account name : GL57635-ECOLAB worked for both Basic Authentication, Key pair Authentication
BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee

2024-04-24T18:20:56.1433333+00:00

Hi

Md, Muzaffar,

Glad the issue was resovled now. I have converted my comment to answer.

If you don't have any further questions, please consider accepting the answer by hitting the Accept answer and up-vote as it helps the community look for answers to similar questions.

Accepted answer

BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee

2024-04-23T16:48:13.04+00:00

After further checking with PG, they confirmed, this is a bug from ADF UI that it's unable to handle the multi-line key properly. The product team is working on a fix for this issue.

As a resolution, Please use Azure CLI to set the private key value in Azure key vault and it works.

az keyvault secret set --vault-name <vaultName> --name <secretName> --file <privateKeyFilePath>

Also please change the account name along with organization name.

This resolves the issue.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

ADF Snowflake Connector - Key pair authentication - Failed to parse PEM block containing the private key.

0 additional answers