Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to Use Quoted Role Identifiers with Snowflake #42134

Open
andresrecalde opened this issue May 1, 2024 · 4 comments
Open

Unable to Use Quoted Role Identifiers with Snowflake #42134

andresrecalde opened this issue May 1, 2024 · 4 comments

Comments

@andresrecalde
Copy link

Describe the bug
Role identifiers are not quoted for Snowflake, which has case-sensitive object naming conventions. For example, Snowflake can have a role with the identifier "test" which Metabase cannot use. This is because when it runs the use role command in Snowflake, it will run use role test which does not exist since, per Snowflake docs, "Unquoted identifiers are stored and resolved in uppercase".

Logs
N/A

To Reproduce
Steps to reproduce the behavior:

  1. Create a case-sensitive identifier in a connected snowflake instance (ex. create role "test";)
  2. In Metabase, attempt to use the role "test". In our example, we attempted to use the role with Impersonation with test as a user attribute.
  3. Fail to properly authenticate with the role.

Expected behavior
A feature flag for a Snowflake connection, similar to DB quoting behavior, that enables always-on identifier quoting for roles (either default or impersonated).

Screenshots
N/A

Severity
This is blocking our roll out of Metabase to our entire user base because it prevents RLS from working from Snowflake. Changing our permissions model is not an option due to the way we have RLS configured and working in Snowflake.

Additional context
N/A

Metabase Diagnostic Info

{
  "browser-info": {
    "language": "en-US",
    "platform": "MacIntel",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",
    "vendor": "Google Inc."
  },
  "system-info": {
    "file.encoding": "UTF-8",
    "java.runtime.name": "OpenJDK Runtime Environment",
    "java.runtime.version": "11.0.22+7",
    "java.vendor": "Eclipse Adoptium",
    "java.vendor.url": "https://adoptium.net/",
    "java.version": "11.0.22",
    "java.vm.name": "OpenJDK 64-Bit Server VM",
    "java.vm.version": "11.0.22+7",
    "os.name": "Linux",
    "os.version": "5.10.214-202.855.amzn2.x86_64",
    "user.language": "en",
    "user.timezone": "GMT"
  },
  "metabase-info": {
    "databases": [
      "postgres",
      "snowflake"
    ],
    "hosting-env": "unknown",
    "application-database": "postgres",
    "application-database-details": {
      "database": {
        "name": "PostgreSQL",
        "version": "14.10"
      },
      "jdbc-driver": {
        "name": "PostgreSQL JDBC Driver",
        "version": "42.7.2"
      }
    },
    "run-mode": "prod",
    "version": {
      "date": "2024-04-22",
      "tag": "v1.49.7",
      "hash": "f0ff786"
    },
    "settings": {
      "report-timezone": null
    }
  }
}
@andresrecalde
Copy link
Author

Related to #27856

@paoliniluis
Copy link
Contributor

Can you write to our support email ?

@camsaul
Copy link
Member

camsaul commented May 7, 2024

See #34858 for context as to why it works this way

@dpsutton
Copy link
Contributor

The thought is to add a checkbox (default to off) when entering the role to enable case sensitive role or somehow indicate that we will use quotes to pass through their value verbatim.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants