snowflake-connector-python 3.15.0__tar.gz → 3.17.0__tar.gz

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/DESCRIPTION.md

@@ -7,6 +7,40 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.17.0(August 16,2025)
+  - Added in-band HTTP exception telemetry.
+  - Added an `unsafe_skip_file_permissions_check` flag to skip file permission checks on the cache and configuration.
+  - Added `APPLICATION_PATH` within `CLIENT_ENVIRONMENT` to distinguish between multiple scripts using the Python Connector in the same environment.
+  - Added basic JSON support for Interval types.
+  - Added in-band OCSP exception telemetry.
+  - Added support for new authentication methods with Workload Identity Federation (WIF).
+    - Added the `WORKLOAD_IDENTITY` value for the authenticator type.
+    - Added the `workload_identity_provider` and `workload_identity_entra_resource` parameters.
+  - Added support for the `use_vectorized_scanner` parameter in the write_pandas function.
+  - Added support of proxy setup using connection parameters without emitting environment variables.
+  - Added populating of `type_code` in `ResultMetadata` for interval types.
+  - Introduced the `snowflake_version` property to the connection.
+  - Moved `OAUTH_TYPE` to `CLIENT_ENVIROMENT`.
+  - Relaxed the `pyarrow` version constrain; versions >= 19 can now be used.
+  - Disabled token caching for OAuth Client Credentials authentication.
+  - Fixed OAuth authenticator values.
+  - Fixed a bug where a PAT with an external session authenticator was used while `external_session_id` was not provided in `SnowflakeRestful.fetch`.
+  - Fixed the case-sensitivity of `Oauth` and `programmatic_access_token` authenticator values.
+  - Fixed unclear error messages for incorrect `authenticator` values.
+  - Fixed GCS staging by ensuring the endpoint has a scheme.
+  - Fixed a bug where time-zoned timestamps fetched as a `pandas.DataFrame` or `pyarrow.Table` would overflow due to unnecessary precision. A clear error will now be raised if an overflow cannot be prevented.
+
+- v3.16.0(July 04,2025)
+  - Bumped numpy dependency from <2.1.0 to <=2.2.4.
+  - Added Windows support for Python 3.13.
+  - Added `bulk_upload_chunks` parameter to `write_pandas` function. Setting this parameter to True changes the behaviour of write_pandas function to first write all the data chunks to the local disk and then perform the wildcard upload of the chunks folder to the stage. In default behaviour the chunks are being saved, uploaded and deleted one by one.
+  - Added support for new authentication mechanism PAT with external session ID.
+  - Added `client_fetch_use_mp` parameter that enables multiprocessed fetching of result batches.
+  - Added basic arrow support for Interval types.
+  - Fixed `write_pandas` special characters usage in the location name.
+  - Fixed usage of `use_virtual_url` when building the location for gcs storage client.
+  - Added support for Snowflake OAuth for local applications.
+
 - v3.15.0(Apr 29,2025)
   - Bumped up min boto and botocore version to 1.24.
   - OCSP: terminate certificates chain traversal if a trusted certificate already reached.

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/MANIFEST.in

@@ -28,3 +28,4 @@ prune tested_requirements
 prune src/snowflake/connector/nanoarrow_cpp/scripts
 prune __pycache__
 prune samples
+prune prober

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.15.0
+Version: 3.17.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -61,7 +61,7 @@ Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: coverage; extra == "development"
 Requires-Dist: more-itertools; extra == "development"
-Requires-Dist: numpy<2.1.0; extra == "development"
+Requires-Dist: numpy<=2.2.4; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
 Requires-Dist: pytest<7.5.0; extra == "development"
@@ -72,7 +72,7 @@ Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
 Provides-Extra: pandas
 Requires-Dist: pandas<3.0.0,>=2.1.2; extra == "pandas"
-Requires-Dist: pyarrow<19.0.0; extra == "pandas"
+Requires-Dist: pyarrow; extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -86,6 +86,40 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.17.0(August 16,2025)
+  - Added in-band HTTP exception telemetry.
+  - Added an `unsafe_skip_file_permissions_check` flag to skip file permission checks on the cache and configuration.
+  - Added `APPLICATION_PATH` within `CLIENT_ENVIRONMENT` to distinguish between multiple scripts using the Python Connector in the same environment.
+  - Added basic JSON support for Interval types.
+  - Added in-band OCSP exception telemetry.
+  - Added support for new authentication methods with Workload Identity Federation (WIF).
+    - Added the `WORKLOAD_IDENTITY` value for the authenticator type.
+    - Added the `workload_identity_provider` and `workload_identity_entra_resource` parameters.
+  - Added support for the `use_vectorized_scanner` parameter in the write_pandas function.
+  - Added support of proxy setup using connection parameters without emitting environment variables.
+  - Added populating of `type_code` in `ResultMetadata` for interval types.
+  - Introduced the `snowflake_version` property to the connection.
+  - Moved `OAUTH_TYPE` to `CLIENT_ENVIROMENT`.
+  - Relaxed the `pyarrow` version constrain; versions >= 19 can now be used.
+  - Disabled token caching for OAuth Client Credentials authentication.
+  - Fixed OAuth authenticator values.
+  - Fixed a bug where a PAT with an external session authenticator was used while `external_session_id` was not provided in `SnowflakeRestful.fetch`.
+  - Fixed the case-sensitivity of `Oauth` and `programmatic_access_token` authenticator values.
+  - Fixed unclear error messages for incorrect `authenticator` values.
+  - Fixed GCS staging by ensuring the endpoint has a scheme.
+  - Fixed a bug where time-zoned timestamps fetched as a `pandas.DataFrame` or `pyarrow.Table` would overflow due to unnecessary precision. A clear error will now be raised if an overflow cannot be prevented.
+
+- v3.16.0(July 04,2025)
+  - Bumped numpy dependency from <2.1.0 to <=2.2.4.
+  - Added Windows support for Python 3.13.
+  - Added `bulk_upload_chunks` parameter to `write_pandas` function. Setting this parameter to True changes the behaviour of write_pandas function to first write all the data chunks to the local disk and then perform the wildcard upload of the chunks folder to the stage. In default behaviour the chunks are being saved, uploaded and deleted one by one.
+  - Added support for new authentication mechanism PAT with external session ID.
+  - Added `client_fetch_use_mp` parameter that enables multiprocessed fetching of result batches.
+  - Added basic arrow support for Interval types.
+  - Fixed `write_pandas` special characters usage in the location name.
+  - Fixed usage of `use_virtual_url` when building the location for gcs storage client.
+  - Added support for Snowflake OAuth for local applications.
+
 - v3.15.0(Apr 29,2025)
   - Bumped up min boto and botocore version to 1.24.
   - OCSP: terminate certificates chain traversal if a trusted certificate already reached.

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/setup.cfg

@@ -83,7 +83,7 @@ development =
 	Cython
 	coverage
 	more-itertools
-	numpy<2.1.0
+	numpy<=2.2.4
 	pendulum!=2.1.1
 	pexpect
 	pytest<7.5.0
@@ -94,7 +94,7 @@ development =
 	pytzdata
 pandas = 
 	pandas>=2.1.2,<3.0.0
-	pyarrow<19.0.0
+	pyarrow
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/setup.py

@@ -103,6 +103,7 @@ if _ABLE_TO_COMPILE_EXTENSIONS and not SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSION
                         "FixedSizeListConverter.cpp",
                         "FloatConverter.cpp",
                         "IntConverter.cpp",
+                        "IntervalConverter.cpp",
                         "MapConverter.cpp",
                         "ObjectConverter.cpp",
                         "SnowflakeType.cpp",

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/_utils.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import string
 from enum import Enum
+from inspect import stack
 from random import choice
 from threading import Timer
 from uuid import UUID
@@ -32,6 +33,15 @@ _PYTHON_SNOWPARK_USE_SCOPED_TEMP_OBJECTS_STRING = (
 
 REQUEST_ID_STATEMENT_PARAM_NAME = "requestId"
 
+# Default server side cap on Degree of Parallelism for file transfer
+# This default value is set to 2^30 (~ 10^9), such that it will not
+# throttle regular sessions.
+_DEFAULT_VALUE_SERVER_DOP_CAP_FOR_FILE_TRANSFER = 1 << 30
+# Variable name of server DoP cap for file transfer
+_VARIABLE_NAME_SERVER_DOP_CAP_FOR_FILE_TRANSFER = (
+    "snowflake_server_dop_cap_for_file_transfer"
+)
+
 
 def generate_random_alphanumeric(length: int = 10) -> str:
     return "".join(choice(ALPHANUMERIC) for _ in range(length))
@@ -60,6 +70,15 @@ def is_uuid4(str_or_uuid: str | UUID) -> bool:
     return uuid_str == str_or_uuid
 
 
+def _snowflake_max_parallelism_for_file_transfer(connection):
+    """Returns the server side cap on max parallelism for file transfer for the given connection."""
+    return getattr(
+        connection,
+        f"_{_VARIABLE_NAME_SERVER_DOP_CAP_FOR_FILE_TRANSFER}",
+        _DEFAULT_VALUE_SERVER_DOP_CAP_FOR_FILE_TRANSFER,
+    )
+
+
 class _TrackedQueryCancellationTimer(Timer):
     def __init__(self, interval, function, args=None, kwargs=None):
         super().__init__(interval, function, args, kwargs)
@@ -68,3 +87,12 @@ class _TrackedQueryCancellationTimer(Timer):
     def run(self):
         super().run()
         self.executed = True
+
+
+def get_application_path() -> str:
+    """Get the path of the application script using the connector."""
+    try:
+        outermost_frame = stack()[-1]
+        return outermost_frame.filename
+    except Exception:
+        return "unknown"

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/arrow_context.py

@@ -13,9 +13,10 @@ from pytz import UTC
 
 from .constants import PARAMETER_TIMEZONE
 from .converter import _generate_tzinfo_from_tzoffset
+from .interval_util import interval_year_month_to_string
 
 if TYPE_CHECKING:
-    from numpy import datetime64, float64, int64
+    from numpy import datetime64, float64, int64, timedelta64
 
 
 try:
@@ -163,3 +164,44 @@ class ArrowConverterContext:
 
     def DECFLOAT_to_numpy_float64(self, exponent: int, significand: bytes) -> float64:
         return numpy.float64(self.DECFLOAT_to_decimal(exponent, significand))
+
+    def INTERVAL_YEAR_MONTH_to_str(self, months: int) -> str:
+        return interval_year_month_to_string(months)
+
+    def INTERVAL_YEAR_MONTH_to_numpy_timedelta(self, months: int) -> timedelta64:
+        return numpy.timedelta64(months, "M")
+
+    def INTERVAL_DAY_TIME_int_to_numpy_timedelta(self, nanos: int) -> timedelta64:
+        return numpy.timedelta64(nanos, "ns")
+
+    def INTERVAL_DAY_TIME_int_to_timedelta(self, nanos: int) -> timedelta:
+        # Python timedelta only supports microsecond precision. We receive value in
+        # nanoseconds.
+        return timedelta(microseconds=nanos // 1000)
+
+    def INTERVAL_DAY_TIME_decimal_to_numpy_timedelta(self, value: bytes) -> timedelta64:
+        # Snowflake supports up to 9 digits leading field precision for the day-time
+        # interval. That when represented in nanoseconds can not be stored in a 64-bit
+        # integer. So we send these as Decimal128 from server to client.
+        # Arrow uses little-endian by default.
+        # https://arrow.apache.org/docs/format/Columnar.html#byte-order-endianness
+        nanos = int.from_bytes(value, byteorder="little", signed=True)
+        # Numpy timedelta only supports up to 64-bit integers, so we need to change the
+        # unit to milliseconds to avoid overflow.
+        # Max value received from server
+        #   = 10**9 * NANOS_PER_DAY - 1
+        #   = 86399999999999999999999 nanoseconds
+        #   = 86399999999999999 milliseconds
+        # math.log2(86399999999999999) = 56.3 < 64
+        return numpy.timedelta64(nanos // 1_000_000, "ms")
+
+    def INTERVAL_DAY_TIME_decimal_to_timedelta(self, value: bytes) -> timedelta:
+        # Snowflake supports up to 9 digits leading field precision for the day-time
+        # interval. That when represented in nanoseconds can not be stored in a 64-bit
+        # integer. So we send these as Decimal128 from server to client.
+        # Arrow uses little-endian by default.
+        # https://arrow.apache.org/docs/format/Columnar.html#byte-order-endianness
+        nanos = int.from_bytes(value, byteorder="little", signed=True)
+        # Python timedelta only supports microsecond precision. We receive value in
+        # nanoseconds.
+        return timedelta(microseconds=nanos // 1000)

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/_auth.py

@@ -17,6 +17,7 @@ from cryptography.hazmat.primitives.serialization import (
     load_pem_private_key,
 )
 
+from .._utils import get_application_path
 from ..compat import urlencode
 from ..constants import (
     DAY_IN_SECONDS,
@@ -51,6 +52,8 @@ from ..network import (
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
+from ..platform_detection import detect_platforms
+from ..session_manager import SessionManager
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..version import VERSION
@@ -100,6 +103,8 @@ class Auth:
         login_timeout: int | None = None,
         network_timeout: int | None = None,
         socket_timeout: int | None = None,
+        platform_detection_timeout_seconds: float | None = None,
+        session_manager: SessionManager | None = None,
     ):
         return {
             "data": {
@@ -110,6 +115,7 @@ class Auth:
                 "LOGIN_NAME": user,
                 "CLIENT_ENVIRONMENT": {
                     "APPLICATION": application,
+                    "APPLICATION_PATH": get_application_path(),
                     "OS": OPERATING_SYSTEM,
                     "OS_VERSION": PLATFORM,
                     "PYTHON_VERSION": PYTHON_VERSION,
@@ -120,6 +126,10 @@ class Auth:
                     "LOGIN_TIMEOUT": login_timeout,
                     "NETWORK_TIMEOUT": network_timeout,
                     "SOCKET_TIMEOUT": socket_timeout,
+                    "PLATFORM": detect_platforms(
+                        platform_detection_timeout_seconds=platform_detection_timeout_seconds,
+                        session_manager=session_manager,
+                    ),
                 },
             },
         }
@@ -175,6 +185,8 @@ class Auth:
             self._rest._connection.login_timeout,
             self._rest._connection._network_timeout,
             self._rest._connection._socket_timeout,
+            self._rest._connection._platform_detection_timeout_seconds,
+            session_manager=self._rest.session_manager.clone(use_pooling=False),
         )
 
         body = copy.deepcopy(body_template)
@@ -540,7 +552,9 @@ class Auth:
 
     def get_token_cache(self) -> TokenCache:
         if self._token_cache is None:
-            self._token_cache = TokenCache.make()
+            self._token_cache = TokenCache.make(
+                skip_file_permissions_check=self._rest._connection._unsafe_skip_file_permissions_check
+            )
         return self._token_cache
 
 

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/_oauth_base.py

@@ -12,11 +12,20 @@ from abc import ABC, abstractmethod
 from typing import TYPE_CHECKING, Any
 from urllib.error import HTTPError, URLError
 
-from ..errorcode import ER_FAILED_TO_REQUEST, ER_IDP_CONNECTION_ERROR
+from ..errorcode import (
+    ER_FAILED_TO_REQUEST,
+    ER_IDP_CONNECTION_ERROR,
+    ER_NO_CLIENT_ID,
+    ER_NO_CLIENT_SECRET,
+)
+from ..errors import Error, ProgrammingError
 from ..network import OAUTH_AUTHENTICATOR
+from ..proxy import get_proxy_url
 from ..secret_detector import SecretDetector
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..vendored import urllib3
+from ..vendored.requests.utils import get_environ_proxies, select_proxy
+from ..vendored.urllib3.poolmanager import ProxyManager
 from .by_plugin import AuthByPlugin, AuthType
 
 if TYPE_CHECKING:
@@ -185,6 +194,33 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         """Returns the token."""
         return self._access_token or ""
 
+    @staticmethod
+    def _validate_client_credentials_present(
+        client_id: str, client_secret: str, connection: SnowflakeConnection
+    ) -> tuple[str, str]:
+        if client_id is None or client_id == "":
+            Error.errorhandler_wrapper(
+                connection,
+                None,
+                ProgrammingError,
+                {
+                    "msg": "Oauth code flow requirement 'client_id' is empty",
+                    "errno": ER_NO_CLIENT_ID,
+                },
+            )
+        if client_secret is None or client_secret == "":
+            Error.errorhandler_wrapper(
+                connection,
+                None,
+                ProgrammingError,
+                {
+                    "msg": "Oauth code flow requirement 'client_secret' is empty",
+                    "errno": ER_NO_CLIENT_SECRET,
+                },
+            )
+
+        return client_id, client_secret
+
     def reauthenticate(
         self,
         *,
@@ -237,7 +273,9 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         """
         body["data"]["AUTHENTICATOR"] = OAUTH_AUTHENTICATOR
         body["data"]["TOKEN"] = self._access_token
-        body["data"]["OAUTH_TYPE"] = self._get_oauth_type_id()
+        if "CLIENT_ENVIRONMENT" not in body["data"]:
+            body["data"]["CLIENT_ENVIRONMENT"] = {}
+        body["data"]["CLIENT_ENVIRONMENT"]["OAUTH_TYPE"] = self._get_oauth_type_id()
 
     def _do_refresh_token(self, conn: SnowflakeConnection) -> None:
         """If a refresh token is available exchanges it with a new access token.
@@ -283,8 +321,14 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         if self._scope:
             fields["scope"] = self._scope
         try:
-            return urllib3.PoolManager().request_encode_body(
-                # TODO: use network pool to gain use of proxy settings and so on
+            # TODO(SNOW-2229411) Session manager should be used here. It may require additional security validation (since we would transition from PoolManager to requests.Session) and some parameters would be passed implicitly. OAuth token exchange must NOT reuse pooled HTTP sessions. We should create a fresh SessionManager with use_pooling=False for each call.
+            proxy_url = self._resolve_proxy_url(conn, self._token_request_url)
+            http_client = (
+                ProxyManager(proxy_url=proxy_url)
+                if proxy_url
+                else urllib3.PoolManager()
+            )
+            return http_client.request_encode_body(
                 "POST",
                 self._token_request_url,
                 encode_multipart=False,
@@ -323,8 +367,12 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         connection: SnowflakeConnection,
         fields: dict[str, str],
     ) -> (str | None, str | None):
-        resp = urllib3.PoolManager().request_encode_body(
-            # TODO: use network pool to gain use of proxy settings and so on
+        # TODO(SNOW-2229411) Session manager should be used here. It may require additional security validation (since we would transition from PoolManager to requests.Session) and some parameters would be passed implicitly. Token request must bypass HTTP connection pools.
+        proxy_url = self._resolve_proxy_url(connection, self._token_request_url)
+        http_client = (
+            ProxyManager(proxy_url=proxy_url) if proxy_url else urllib3.PoolManager()
+        )
+        resp = http_client.request_encode_body(
             "POST",
             self._token_request_url,
             headers=self._create_token_request_headers(),
@@ -365,3 +413,25 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             "Accept": "application/json",
             "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
         }
+
+    @staticmethod
+    def _resolve_proxy_url(
+        connection: SnowflakeConnection, request_url: str
+    ) -> str | None:
+        # TODO(SNOW-2229411) Session manager should be used instead. It may require additional security validation.
+        """Resolve proxy URL from explicit config first, then environment variables."""
+        # First try explicit proxy configuration from connection parameters
+        proxy_url = get_proxy_url(
+            connection.proxy_host,
+            connection.proxy_port,
+            connection.proxy_user,
+            connection.proxy_password,
+        )
+
+        if proxy_url:
+            return proxy_url
+
+        # Fall back to environment variables (HTTP_PROXY, HTTPS_PROXY)
+        # Use proper proxy selection that considers the URL scheme
+        proxies = get_environ_proxies(request_url)
+        return select_proxy(request_url, proxies)

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/by_plugin.py

@@ -50,9 +50,10 @@ class AuthType(Enum):
     ID_TOKEN = "ID_TOKEN"
     USR_PWD_MFA = "USERNAME_PASSWORD_MFA"
     OKTA = "OKTA"
-    PAT = "PROGRAMMATIC_ACCESS_TOKEN'"
+    PAT = "PROGRAMMATIC_ACCESS_TOKEN"
     NO_AUTH = "NO_AUTH"
     WORKLOAD_IDENTITY = "WORKLOAD_IDENTITY"
+    PAT_WITH_EXTERNAL_SESSION = "PAT_WITH_EXTERNAL_SESSION"
 
 
 class AuthByPlugin(ABC):

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/oauth_code.py

@@ -18,11 +18,13 @@ from typing import TYPE_CHECKING, Any
 from ..compat import parse_qs, urlparse, urlsplit
 from ..constants import OAUTH_TYPE_AUTHORIZATION_CODE
 from ..errorcode import (
+    ER_INVALID_VALUE,
     ER_OAUTH_CALLBACK_ERROR,
     ER_OAUTH_SERVER_TIMEOUT,
     ER_OAUTH_STATE_CHANGED,
     ER_UNABLE_TO_OPEN_BROWSER,
 )
+from ..errors import Error, ProgrammingError
 from ..token_cache import TokenCache
 from ._http_server import AuthHttpServer
 from ._oauth_base import AuthByOAuthBase
@@ -45,6 +47,8 @@ def _get_query_params(
 class AuthByOauthCode(AuthByOAuthBase):
     """Authenticates user by OAuth code flow."""
 
+    _LOCAL_APPLICATION_CLIENT_CREDENTIALS = "LOCAL_APPLICATION"
+
     def __init__(
         self,
         application: str,
@@ -54,13 +58,27 @@ class AuthByOauthCode(AuthByOAuthBase):
         token_request_url: str,
         redirect_uri: str,
         scope: str,
+        host: str,
         pkce_enabled: bool = True,
         token_cache: TokenCache | None = None,
         refresh_token_enabled: bool = False,
         external_browser_timeout: int | None = None,
         enable_single_use_refresh_tokens: bool = False,
+        connection: SnowflakeConnection | None = None,
         **kwargs,
     ) -> None:
+        authentication_url, redirect_uri = self._validate_oauth_code_uris(
+            authentication_url, redirect_uri, connection
+        )
+        client_id, client_secret = self._validate_client_credentials_with_defaults(
+            client_id,
+            client_secret,
+            authentication_url,
+            token_request_url,
+            host,
+            connection,
+        )
+
         super().__init__(
             client_id=client_id,
             client_secret=client_secret,
@@ -251,6 +269,7 @@ You can close this window now and go back where you started from.
             "login. If you can't see it, check existing browser windows, "
             "or your OS settings. Press CTRL+C to abort and try again..."
         )
+        # TODO(SNOW-2229411) Investigate if Session manager / Http Config should be used here.
         code, state = (
             self._receive_authorization_callback(callback_server, connection)
             if webbrowser.open(authorization_request)
@@ -385,3 +404,77 @@ You can close this window now and go back where you started from.
                 },
             )
         return parsed.get("code", [None])[0], parsed.get("state", [None])[0]
+
+    @staticmethod
+    def _is_snowflake_as_idp(
+        authentication_url: str, token_request_url: str, host: str
+    ) -> bool:
+        return (authentication_url == "" or host in authentication_url) and (
+            token_request_url == "" or host in token_request_url
+        )
+
+    def _eligible_for_default_client_credentials(
+        self,
+        client_id: str,
+        client_secret: str,
+        authorization_url: str,
+        token_request_url: str,
+        host: str,
+    ) -> bool:
+        return (
+            (client_id == "" or client_secret is None)
+            and (client_secret == "" or client_secret is None)
+            and self.__class__._is_snowflake_as_idp(
+                authorization_url, token_request_url, host
+            )
+        )
+
+    def _validate_client_credentials_with_defaults(
+        self,
+        client_id: str,
+        client_secret: str,
+        authorization_url: str,
+        token_request_url: str,
+        host: str,
+        connection: SnowflakeConnection,
+    ) -> tuple[str, str] | None:
+        if self._eligible_for_default_client_credentials(
+            client_id, client_secret, authorization_url, token_request_url, host
+        ):
+            return (
+                self.__class__._LOCAL_APPLICATION_CLIENT_CREDENTIALS,
+                self.__class__._LOCAL_APPLICATION_CLIENT_CREDENTIALS,
+            )
+        else:
+            self._validate_client_credentials_present(
+                client_id, client_secret, connection
+            )
+            return client_id, client_secret
+
+    @staticmethod
+    def _validate_oauth_code_uris(
+        authorization_url: str, redirect_uri: str, connection: SnowflakeConnection
+    ) -> tuple[str, str]:
+        if authorization_url and not authorization_url.startswith("https://"):
+            Error.errorhandler_wrapper(
+                connection,
+                None,
+                ProgrammingError,
+                {
+                    "msg": "OAuth supports only authorization urls that use 'https' scheme",
+                    "errno": ER_INVALID_VALUE,
+                },
+            )
+        if redirect_uri and not (
+            redirect_uri.startswith("http://") or redirect_uri.startswith("https://")
+        ):
+            Error.errorhandler_wrapper(
+                connection,
+                None,
+                ProgrammingError,
+                {
+                    "msg": "OAuth supports only authorization urls that use 'http(s)' scheme",
+                    "errno": ER_INVALID_VALUE,
+                },
+            )
+        return authorization_url, redirect_uri

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/oauth_credentials.py

@@ -8,7 +8,6 @@ import logging
 from typing import TYPE_CHECKING, Any
 
 from ..constants import OAUTH_TYPE_CLIENT_CREDENTIALS
-from ..token_cache import TokenCache
 from ._oauth_base import AuthByOAuthBase
 
 if TYPE_CHECKING:
@@ -27,17 +26,17 @@ class AuthByOauthCredentials(AuthByOAuthBase):
         client_secret: str,
         token_request_url: str,
         scope: str,
-        token_cache: TokenCache | None = None,
-        refresh_token_enabled: bool = False,
+        connection: SnowflakeConnection | None = None,
         **kwargs,
     ) -> None:
+        self._validate_client_credentials_present(client_id, client_secret, connection)
         super().__init__(
             client_id=client_id,
             client_secret=client_secret,
             token_request_url=token_request_url,
             scope=scope,
-            token_cache=token_cache,
-            refresh_token_enabled=refresh_token_enabled,
+            token_cache=None,
+            refresh_token_enabled=False,
             **kwargs,
         )
         self._application = application

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/okta.py

@@ -168,6 +168,7 @@ class AuthByOkta(AuthByPlugin):
             conn._ocsp_mode(),
             conn.login_timeout,
             conn._network_timeout,
+            session_manager=conn._session_manager.clone(use_pooling=False),
         )
 
         body["data"]["AUTHENTICATOR"] = authenticator
@@ -235,7 +236,7 @@ class AuthByOkta(AuthByPlugin):
             "username": user,
             "password": password,
         }
-        ret = conn._rest.fetch(
+        ret = conn.rest.fetch(
             "post",
             token_url,
             headers,
@@ -285,7 +286,7 @@ class AuthByOkta(AuthByPlugin):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
-                response_html = conn._rest.fetch(
+                response_html = conn.rest.fetch(
                     "get",
                     sso_url,
                     headers,

{snowflake_connector_python-3.15.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/pat.py

@@ -13,6 +13,7 @@ class AuthByPAT(AuthByPlugin):
         super().__init__(**kwargs)
         self._pat_token: str | None = pat_token
 
+    @property
     def type_(self) -> AuthType:
         return AuthType.PAT