ADF Snowflake Connector - Key pair authentication - Failed to parse PEM block containing the private key.

Question

ADF Snowflake Connector - Key pair authentication - Failed to parse PEM block containing the private key.

Md, Muzaffar 25

I have created RSA key pair for my snowflake service account.

I tested authenticating snowflake with this RSA keys in python. Data from snowflake loaded successfully.

Now I'm trying to use this RSA private key for authentication in ADF.

I have followed step by step procedure from this documentation.

https://learn.microsoft.com/en-us/azure/data-factory/connector-snowflake?tabs=data-factory#key-pair-authentication

But my Privatekey is not working in the snowflake connector.

Added newline characters (\n) to each line in the privatekey file as per above documentation
[image]

This is my private key

[image]

While addign this private key in linked service getting this error - Failed to parse PEM block containing the private key.

[image]

Tried in all the ways like - adding newline char (\n), removing newline char, removing header (-----BEGIN PRIVATE KEY-----) & footer (-----END PRIVATE KEY-----) of private key.. nothing worked.

I have checked for special characters in my key. I have these three special characters + / = in my key.

Can anyone please help me on this.

Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-22T21:23:40.0666667+00:00

Hello Md, Muzaffar,

Welcome to the Microsoft Q&A forum.

Please check if you are using the account name along with its organization.

For example, myorg-account123.

https://learn.microsoft.com/en-us/azure/data-factory/connector-snowflake?tabs=data-factory#linked-service-properties
Md, Muzaffar 25 Reputation points

2024-04-23T02:43:08.93+00:00

Hi @Bhargava-MSFT

For Basic authentication I used accountIdentifier = *******
This worked for basic authentication.
[image]

As per your comment, For Key pair Authentication I tried with -

different formats

I'm same error for all the Account Identifiers
[image]

Not sure if any issue with format of primary key
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-23T15:45:28.27+00:00

Could you try use Azure Key Vault to store the privateKey and use keyPair auth?

Customer can upload privateKey file to azure keyVault by "az keyvault secret set --vault-name <vaultName>--name <secretName> --file <privateKeyFilePath>" and use key vault stored privateKey to connect with snowflake database.

If the above doesn't work- then please try edit linked service json.

another work around is to see if the connection was successful using Key Pair config via ODBC

You can follow the below document.

https://community.snowflake.com/s/article/How-to-set-up-ODBC-Driver-with-key-pair-authentication-to-connect-to-Snowflake-on-Windows
Md, Muzaffar 25 Reputation points

2024-04-23T15:54:09.7533333+00:00

Uploaded the private key into key vault using CLI. Now getting this error - JWT token is invalid

[image]
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-23T16:39:19.88+00:00

it looks like the value seems to be incorrect

Below is the sample privateKey format and make sure the privateKey value is like this without quotation and each one-line privateKey string with "\n".
Md, Muzaffar 25 Reputation points

2024-04-23T17:42:02.16+00:00

Yes used CLI to upload the key file.

I uploaded original private key in CLI and it showed \n for each newline like this.

But if we check the keyvault there is newline in the key instead of \n. (understood the usage of CLI here)

but now i’m getting this error - JWT token is invalid.

Need to confirm with my account name : ecolab.east-us-2.azure

This is working for Basic Authentication. Not sure the same will work for key pair authentication or we need to change it.
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-23T17:53:14.7566667+00:00

Md, Muzaffar

Can you also change the account name along with organization?
Md, Muzaffar 25 Reputation points

2024-04-24T04:46:03.3133333+00:00

Thank you @Bhargava-MSFT
Changed account name to GL57635-ECOLAB

This worked. The connection is successful.
account name : ecolab.east-us-2.azure worked for only Basic Authentication
account name : GL57635-ECOLAB worked for both Basic Authentication, Key pair Authentication
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-24T18:20:56.1433333+00:00

Hi

Md, Muzaffar,

Glad the issue was resovled now. I have converted my comment to answer.

If you don't have any further questions, please consider accepting the answer by hitting the Accept answer and up-vote as it helps the community look for answers to similar questions.
Marti Kevin, BKW Energie AG 5 Reputation points

2024-05-27T10:54:50.5966667+00:00

The issue still persists. I have the same issue and i used the exact same steps only difference, i used an encrypted private key. any idea how to solve it? I actually added \n for every new line and used the orgid-acountid identifier. Edit the \n is not necessary anymore please update your official documentation!
DELAROSA Jose 0 Reputation points

2025-05-21T15:41:16.9533333+00:00

What is the status of this bug? Has it been resolved? If not, Is there a timeline?

Accepted answer

0 additional answers

Your answer

Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-22T21:23:40.0666667+00:00

Hello Md, Muzaffar,

Welcome to the Microsoft Q&A forum.

Please check if you are using the account name along with its organization.

For example, myorg-account123.

https://learn.microsoft.com/en-us/azure/data-factory/connector-snowflake?tabs=data-factory#linked-service-properties
Md, Muzaffar 25 Reputation points

2024-04-23T02:43:08.93+00:00

Hi @Bhargava-MSFT

For Basic authentication I used accountIdentifier = *******
This worked for basic authentication.
[image]

As per your comment, For Key pair Authentication I tried with -

different formats

I'm same error for all the Account Identifiers
[image]

Not sure if any issue with format of primary key
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-23T15:45:28.27+00:00

Could you try use Azure Key Vault to store the privateKey and use keyPair auth?

Customer can upload privateKey file to azure keyVault by "az keyvault secret set --vault-name <vaultName>--name <secretName> --file <privateKeyFilePath>" and use key vault stored privateKey to connect with snowflake database.

If the above doesn't work- then please try edit linked service json.

another work around is to see if the connection was successful using Key Pair config via ODBC

You can follow the below document.

https://community.snowflake.com/s/article/How-to-set-up-ODBC-Driver-with-key-pair-authentication-to-connect-to-Snowflake-on-Windows
Md, Muzaffar 25 Reputation points

2024-04-23T15:54:09.7533333+00:00

Uploaded the private key into key vault using CLI. Now getting this error - JWT token is invalid

[image]
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-23T16:39:19.88+00:00

it looks like the value seems to be incorrect

Below is the sample privateKey format and make sure the privateKey value is like this without quotation and each one-line privateKey string with "\n".
Md, Muzaffar 25 Reputation points

2024-04-23T17:42:02.16+00:00

Yes used CLI to upload the key file.

I uploaded original private key in CLI and it showed \n for each newline like this.

But if we check the keyvault there is newline in the key instead of \n. (understood the usage of CLI here)

but now i’m getting this error - JWT token is invalid.

Need to confirm with my account name : ecolab.east-us-2.azure

This is working for Basic Authentication. Not sure the same will work for key pair authentication or we need to change it.
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-23T17:53:14.7566667+00:00

Md, Muzaffar

Can you also change the account name along with organization?
Md, Muzaffar 25 Reputation points

2024-04-24T04:46:03.3133333+00:00

Thank you @Bhargava-MSFT
Changed account name to GL57635-ECOLAB

This worked. The connection is successful.
account name : ecolab.east-us-2.azure worked for only Basic Authentication
account name : GL57635-ECOLAB worked for both Basic Authentication, Key pair Authentication
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2024-04-24T18:20:56.1433333+00:00

Hi

Md, Muzaffar,

Glad the issue was resovled now. I have converted my comment to answer.

If you don't have any further questions, please consider accepting the answer by hitting the Accept answer and up-vote as it helps the community look for answers to similar questions.
Marti Kevin, BKW Energie AG 5 Reputation points

2024-05-27T10:54:50.5966667+00:00

The issue still persists. I have the same issue and i used the exact same steps only difference, i used an encrypted private key. any idea how to solve it? I actually added \n for every new line and used the orgid-acountid identifier. Edit the \n is not necessary anymore please update your official documentation!
DELAROSA Jose 0 Reputation points

2025-05-21T15:41:16.9533333+00:00

What is the status of this bug? Has it been resolved? If not, Is there a timeline?

Answer 1

Bhargava-MSFT 31,261 Microsoft Employee Moderator

After further checking with PG, they confirmed, this is a bug from ADF UI that it's unable to handle the multi-line key properly. The product team is working on a fix for this issue.

As a resolution, Please use Azure CLI to set the private key value in Azure key vault and it works.

az keyvault secret set --vault-name <vaultName> --name <secretName> --file <privateKeyFilePath>

Also please change the account name along with organization name.

This resolves the issue.

Jan Kučera 0 Reputation points

2024-07-02T12:50:34.9+00:00

I've figured out this part. The problem for me was, that I was using the wrong account name (worked for basic, not for key-pair).
Sairam Vijai 0 Reputation points

2024-09-12T10:00:09.7566667+00:00

Hi, can you please help clarify if the secret has to be created only via CLI or can be created from KV UI? Also, I have stored the pvt key file content as a single line specifying "\n" at the end of each line in the pem file. However, it still does not seem to work ("Failed to parse PEM block containing the private key.") Could you please clarify on how the content should be stored?

Attaching how the content looks
PK 25 Reputation points

2025-02-18T02:02:00.7333333+00:00

Is this bug resolved ? I am trying to connect from ADF to Snowflake using Key Pait authentication and i have added the private key to the Azure Key Vault but it is not working. Please help.
PK 25 Reputation points

2025-02-18T18:59:47.15+00:00

@Bhargava-MSFT Can you please have a look at it.

Share via

ADF Snowflake Connector - Key pair authentication - Failed to parse PEM block containing the private key.

0 additional answers

Your answer