snowflake-connector-python 3.18.0__tar.gz → 4.1.0__tar.gz

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/DESCRIPTION.md

@@ -7,8 +7,34 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.19.0(TBD)
-  - N/A
+- v4.1.0(November 18,2025)
+  - Added the `SNOWFLAKE_AUTH_FORCE_SERVER` environment variable to force the use of the local-listening server when using the `externalbrowser` auth method.
+    - This allows headless environments (like Docker or Airflow) running locally to auth via a browser URL.
+  - Fix compilation error when building from sources with libc++.
+  - Pin lower versions of dependencies to oldest version without vulnerabilities.
+  - Added no_proxy parameter for proxy configuration without using environmental variables.
+  - Added OAUTH_AUTHORIZATION_CODE and OAUTH_CLIENT_CREDENTIALS to list of authenticators that don't require user to be set
+  - Added `oauth_socket_uri` connection parameter allowing to separate server and redirect URIs for local OAuth server.
+  - Made platform_detection logs silent and improved its timeout handling. Added support for ENV_VAR_DISABLE_PLATFORM_DETECTION environment variable.
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
+
+- v4.0.0(October 09,2025)
+  - Added support for checking certificates revocation using revocation lists (CRLs)
+  - Added `CERT_REVOCATION_CHECK_MODE` to `CLIENT_ENVIRONMENT`
+  - Added the `workload_identity_impersonation_path` parameter to support service account impersonation for Workload Identity Federation on GCP and AWS workloads only
+  - Fixed `get_results_from_sfqid` when using `DictCursor` and executing multiple statements at once
+  - Added the `oauth_credentials_in_body` parameter supporting an option to send the oauth client credentials in the request body
+  - Fix retry behavior for `ECONNRESET` error
+  - Added an option to exclude `botocore` and `boto3` dependencies by setting `SNOWFLAKE_NO_BOTO` environment variable during installation
+  - Revert changing exception type in case of token expired scenario for `Oauth` authenticator back to `DatabaseError`
+  - Enhanced configuration file security checks with stricter permission validation.
+    - Configuration files writable by group or others now raise a `ConfigSourceError` with detailed permission information, preventing potential credential tampering.
+  - Fixed the return type of `SnowflakeConnection.cursor(cursor_class)` to match the type of `cursor_class`
+  - Constrained the types of `fetchone`, `fetchmany`, `fetchall`
+    - As part of this fix, `DictCursor` is no longer a subclass of `SnowflakeCursor`; use `SnowflakeCursorBase` as a superclass of both.
+  - Fix "No AWS region was found" error if AWS region was set in `AWS_DEFAULT_REGION` variable instead of `AWS_REGION` for `WORKLOAD_IDENTITY` authenticator
+  - Add `ocsp_root_certs_dict_lock_timeout` connection parameter to set the timeout (in seconds) for acquiring the lock on the OCSP root certs dictionary. Default value for this parameter is -1 which indicates no timeout.
+  - Fixed behaviour of trying S3 Transfer Accelerate endpoint by default for internal stages, and always getting HTTP403 due to permissions missing on purpose. Now /accelerate is not attempted.
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types
@@ -16,6 +42,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 - v3.17.4(September 22,2025)
   - Added support for intermediate certificates as roots when they are stored in the trust store
   - Bumped up vendored `urllib3` to `2.5.0` and `requests` to `v2.32.5`
+  - Dropped support for OpenSSL versions older than 1.1.1
 
 - v3.17.3(September 02,2025)
   - Enhanced configuration file permission warning messages.

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.18.0
+Version: 4.1.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -39,24 +39,26 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: boto3>=1.24
-Requires-Dist: botocore>=1.24
-Requires-Dist: cffi<2.0.0,>=1.9
-Requires-Dist: cryptography>=3.1.0
-Requires-Dist: pyOpenSSL<26.0.0,>=22.0.0
-Requires-Dist: pyjwt<3.0.0
+Requires-Dist: cryptography>=44.0.1
+Requires-Dist: pyOpenSSL<26.0.0,>=24.0.0
+Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
-Requires-Dist: requests<3.0.0
+Requires-Dist: requests<3.0.0,>=2.32.4
 Requires-Dist: packaging
 Requires-Dist: charset_normalizer<4,>=2
-Requires-Dist: idna<4,>=2.5
-Requires-Dist: urllib3<2.0.0,>=1.21.1; python_version < "3.10"
-Requires-Dist: certifi>=2017.4.17
+Requires-Dist: idna<4,>=3.7
+Requires-Dist: urllib3<2.0.0,>=1.26.5; python_version < "3.10"
+Requires-Dist: certifi>=2024.7.4
 Requires-Dist: typing_extensions<5,>=4.3
 Requires-Dist: filelock<4,>=3.5
 Requires-Dist: sortedcontainers>=2.4.0
 Requires-Dist: platformdirs<5.0.0,>=2.6.0
 Requires-Dist: tomlkit
+Requires-Dist: boto3>=1.24
+Requires-Dist: botocore>=1.24
+Provides-Extra: boto
+Requires-Dist: boto3>=1.24; extra == "boto"
+Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: coverage; extra == "development"
@@ -70,12 +72,14 @@ Requires-Dist: pytest-rerunfailures<16.0; extra == "development"
 Requires-Dist: pytest-timeout; extra == "development"
 Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
+Requires-Dist: responses; extra == "development"
 Provides-Extra: pandas
 Requires-Dist: pandas<3.0.0,>=2.1.2; extra == "pandas"
-Requires-Dist: pyarrow; extra == "pandas"
+Requires-Dist: pyarrow>=14.0.1; extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
+Dynamic: requires-dist
 
 This package includes the Snowflake Connector for Python, which conforms to the Python DB API 2.0 specification:
 https://www.python.org/dev/peps/pep-0249/
@@ -86,8 +90,34 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.19.0(TBD)
-  - N/A
+- v4.1.0(November 18,2025)
+  - Added the `SNOWFLAKE_AUTH_FORCE_SERVER` environment variable to force the use of the local-listening server when using the `externalbrowser` auth method.
+    - This allows headless environments (like Docker or Airflow) running locally to auth via a browser URL.
+  - Fix compilation error when building from sources with libc++.
+  - Pin lower versions of dependencies to oldest version without vulnerabilities.
+  - Added no_proxy parameter for proxy configuration without using environmental variables.
+  - Added OAUTH_AUTHORIZATION_CODE and OAUTH_CLIENT_CREDENTIALS to list of authenticators that don't require user to be set
+  - Added `oauth_socket_uri` connection parameter allowing to separate server and redirect URIs for local OAuth server.
+  - Made platform_detection logs silent and improved its timeout handling. Added support for ENV_VAR_DISABLE_PLATFORM_DETECTION environment variable.
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
+
+- v4.0.0(October 09,2025)
+  - Added support for checking certificates revocation using revocation lists (CRLs)
+  - Added `CERT_REVOCATION_CHECK_MODE` to `CLIENT_ENVIRONMENT`
+  - Added the `workload_identity_impersonation_path` parameter to support service account impersonation for Workload Identity Federation on GCP and AWS workloads only
+  - Fixed `get_results_from_sfqid` when using `DictCursor` and executing multiple statements at once
+  - Added the `oauth_credentials_in_body` parameter supporting an option to send the oauth client credentials in the request body
+  - Fix retry behavior for `ECONNRESET` error
+  - Added an option to exclude `botocore` and `boto3` dependencies by setting `SNOWFLAKE_NO_BOTO` environment variable during installation
+  - Revert changing exception type in case of token expired scenario for `Oauth` authenticator back to `DatabaseError`
+  - Enhanced configuration file security checks with stricter permission validation.
+    - Configuration files writable by group or others now raise a `ConfigSourceError` with detailed permission information, preventing potential credential tampering.
+  - Fixed the return type of `SnowflakeConnection.cursor(cursor_class)` to match the type of `cursor_class`
+  - Constrained the types of `fetchone`, `fetchmany`, `fetchall`
+    - As part of this fix, `DictCursor` is no longer a subclass of `SnowflakeCursor`; use `SnowflakeCursorBase` as a superclass of both.
+  - Fix "No AWS region was found" error if AWS region was set in `AWS_DEFAULT_REGION` variable instead of `AWS_REGION` for `WORKLOAD_IDENTITY` authenticator
+  - Add `ocsp_root_certs_dict_lock_timeout` connection parameter to set the timeout (in seconds) for acquiring the lock on the OCSP root certs dictionary. Default value for this parameter is -1 which indicates no timeout.
+  - Fixed behaviour of trying S3 Transfer Accelerate endpoint by default for internal stages, and always getting HTTP403 due to permissions missing on purpose. Now /accelerate is not attempted.
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types
@@ -95,6 +125,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 - v3.17.4(September 22,2025)
   - Added support for intermediate certificates as roots when they are stored in the trust store
   - Bumped up vendored `urllib3` to `2.5.0` and `requests` to `v2.32.5`
+  - Dropped support for OpenSSL versions older than 1.1.1
 
 - v3.17.3(September 02,2025)
   - Enhanced configuration file permission warning messages.

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/setup.cfg

@@ -44,19 +44,16 @@ python_requires = >=3.9
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
-	boto3>=1.24
-	botocore>=1.24
-	cffi>=1.9,<2.0.0
-	cryptography>=3.1.0
-	pyOpenSSL>=22.0.0,<26.0.0
-	pyjwt<3.0.0
+	cryptography>=44.0.1
+	pyOpenSSL>=24.0.0,<26.0.0
+	pyjwt>=2.10.1,<3.0.0
 	pytz
-	requests<3.0.0
+	requests>=2.32.4,<3.0.0
 	packaging
 	charset_normalizer>=2,<4
-	idna>=2.5,<4
-	urllib3>=1.21.1,<2.0.0; python_version < '3.10'
-	certifi>=2017.4.17
+	idna>=3.7,<4
+	urllib3>=1.26.5,<2.0.0; python_version < '3.10'
+	certifi>=2024.7.4
 	typing_extensions>=4.3,<5
 	filelock>=3.5,<4
 	sortedcontainers>=2.4.0
@@ -79,6 +76,9 @@ console_scripts =
 	snowflake-dump-certs = snowflake.connector.tool.dump_certs:main
 
 [options.extras_require]
+boto = 
+	boto3>=1.24
+	botocore>=1.24
 development = 
 	Cython
 	coverage
@@ -92,9 +92,10 @@ development =
 	pytest-timeout
 	pytest-xdist
 	pytzdata
+	responses
 pandas = 
 	pandas>=2.1.2,<3.0.0
-	pyarrow
+	pyarrow>=14.0.1
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/setup.py

@@ -5,6 +5,7 @@ import sys
 import warnings
 
 from setuptools import Extension, setup
+from setuptools.command.egg_info import egg_info
 
 CONNECTOR_SRC_DIR = os.path.join("src", "snowflake", "connector")
 NANOARROW_SRC_DIR = os.path.join(CONNECTOR_SRC_DIR, "nanoarrow_cpp", "ArrowIterator")
@@ -38,9 +39,14 @@ for flag in options_def:
 extensions = None
 cmd_class = {}
 
-SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSIONS = os.environ.get(
-    "SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSIONS", "false"
-).lower() in ("y", "yes", "t", "true", "1", "on")
+_POSITIVE_VALUES = ("y", "yes", "t", "true", "1", "on")
+SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSIONS = (
+    os.environ.get("SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSIONS", "false").lower()
+    in _POSITIVE_VALUES
+)
+SNOWFLAKE_NO_BOTO = (
+    os.environ.get("SNOWFLAKE_NO_BOTO", "false").lower() in _POSITIVE_VALUES
+)
 
 try:
     from Cython.Build import cythonize
@@ -88,7 +94,7 @@ if _ABLE_TO_COMPILE_EXTENSIONS and not SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSION
                 ext.sources += [
                     os.path.join(
                         NANOARROW_ARROW_ITERATOR_SRC_DIR,
-                        *((file,) if isinstance(file, str) else file)
+                        *((file,) if isinstance(file, str) else file),
                     )
                     for file in {
                         "ArrayConverter.cpp",
@@ -174,6 +180,22 @@ if _ABLE_TO_COMPILE_EXTENSIONS and not SNOWFLAKE_DISABLE_COMPILE_ARROW_EXTENSION
 
     cmd_class = {"build_ext": MyBuildExt}
 
+
+class SetDefaultInstallationExtras(egg_info):
+    """Adds AWS extra unless SNOWFLAKE_NO_BOTO is specified."""
+
+    def finalize_options(self):
+        super().finalize_options()
+
+        # if not explicitly excluded, add boto dependencies to install_requires
+        if not SNOWFLAKE_NO_BOTO:
+            boto_extras = self.distribution.extras_require.get("boto", [])
+            self.distribution.install_requires += boto_extras
+
+
+# Update command classes
+cmd_class["egg_info"] = SetDefaultInstallationExtras
+
 setup(
     version=version,
     ext_modules=extensions,

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/_auth.py

@@ -53,11 +53,14 @@ from ..network import (
     ReauthenticationRequest,
 )
 from ..platform_detection import detect_platforms
-from ..session_manager import SessionManager
+from ..session_manager import BaseHttpConfig, HttpConfig
+from ..session_manager import SessionManager as SyncSessionManager
+from ..session_manager import SessionManagerFactory
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..version import VERSION
 from .no_auth import AuthNoAuth
+from .oauth import AuthByOAuth
 
 if TYPE_CHECKING:
     from . import AuthByPlugin
@@ -100,12 +103,22 @@ class Auth:
         internal_application_name,
         internal_application_version,
         ocsp_mode,
+        cert_revocation_check_mode,
         login_timeout: int | None = None,
         network_timeout: int | None = None,
         socket_timeout: int | None = None,
         platform_detection_timeout_seconds: float | None = None,
-        session_manager: SessionManager | None = None,
+        session_manager: SyncSessionManager | None = None,
+        http_config: BaseHttpConfig | None = None,
     ):
+        # Create sync SessionManager for platform detection if config is provided
+        # Platform detection runs in threads and uses sync SessionManager
+        if http_config is not None and session_manager is None:
+            # Extract base fields (automatically excludes subclass-specific fields)
+            # Note: It won't be possible to pass adapter_factory from outer async-code to this part of code
+            sync_config = HttpConfig(**http_config.to_base_dict())
+            session_manager = SessionManagerFactory.get_manager(config=sync_config)
+
         return {
             "data": {
                 "CLIENT_APP_ID": internal_application_name,
@@ -122,6 +135,7 @@ class Auth:
                     "PYTHON_RUNTIME": IMPLEMENTATION,
                     "PYTHON_COMPILER": COMPILER,
                     "OCSP_MODE": ocsp_mode.name,
+                    "CERT_REVOCATION_CHECK_MODE": cert_revocation_check_mode,
                     "TRACING": logger.getEffectiveLevel(),
                     "LOGIN_TIMEOUT": login_timeout,
                     "NETWORK_TIMEOUT": network_timeout,
@@ -182,6 +196,7 @@ class Auth:
             self._rest._connection._internal_application_name,
             self._rest._connection._internal_application_version,
             self._rest._connection._ocsp_mode(),
+            self._rest._connection.cert_revocation_check_mode,
             self._rest._connection.login_timeout,
             self._rest._connection._network_timeout,
             self._rest._connection._socket_timeout,
@@ -373,7 +388,11 @@ class Auth:
                         sqlstate=SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
                     )
                 )
-            elif errno == OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE:
+            elif (errno == OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) and (
+                # SNOW-2329031: OAuth v1.0 does not support token renewal,
+                # for backward compatibility, we do not raise an exception here
+                not isinstance(auth_instance, AuthByOAuth)
+            ):
                 raise ReauthenticationRequest(
                     ProgrammingError(
                         msg=ret["message"],
@@ -495,6 +514,16 @@ class Auth:
         user: str,
         session_parameters: dict[str, Any],
     ) -> None:
+        """Attempt to load cached credentials to skip interactive authentication.
+
+        SSO (ID_TOKEN): If present, avoids opening browser for external authentication.
+            Controlled by client_store_temporary_credential parameter.
+
+        MFA (MFA_TOKEN): If present, skips MFA prompt on next connection.
+            Controlled by client_request_mfa_token parameter.
+
+        If cached tokens are expired/invalid, they're deleted and normal auth proceeds.
+        """
         if session_parameters.get(PARAMETER_CLIENT_STORE_TEMPORARY_CREDENTIAL, False):
             self._rest.id_token = self._read_temporary_credential(
                 host,
@@ -530,6 +559,13 @@ class Auth:
         session_parameters: dict[str, Any],
         response: dict[str, Any],
     ) -> None:
+        """Cache credentials received from successful authentication for future use.
+
+        Tokens are only cached if:
+        1. Server returned the token in response (server-side caching must be enabled)
+        2. Client has caching enabled via session parameters
+        3. User consented to caching (consent_cache_id_token for ID tokens)
+        """
         if (
             self._rest._connection.auth_class.consent_cache_id_token
             and session_parameters.get(

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/_http_server.py

@@ -70,8 +70,10 @@ class AuthHttpServer:
         self,
         uri: str,
         buf_size: int = 16384,
+        redirect_uri: str | None = None,
     ) -> None:
         parsed_uri = urllib.parse.urlparse(uri)
+        parsed_redirect = urllib.parse.urlparse(redirect_uri) if redirect_uri else None
         self._socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
         self.buf_size = buf_size
         if os.getenv("SNOWFLAKE_AUTH_SOCKET_REUSE_PORT", "False").lower() == "true":
@@ -82,30 +84,34 @@ class AuthHttpServer:
             else:
                 self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
 
-        port = parsed_uri.port or 0
+        if parsed_redirect and self._is_local_uri(parsed_redirect):
+            server_port = parsed_redirect.port or 0
+        else:
+            server_port = parsed_uri.port or 0
+
         for attempt in range(1, self.DEFAULT_MAX_ATTEMPTS + 1):
             try:
                 self._socket.bind(
                     (
                         parsed_uri.hostname,
-                        port,
+                        server_port,
                     )
                 )
                 break
             except socket.gaierror as ex:
                 logger.error(
-                    f"Failed to bind authorization callback server to port {port}: {ex}"
+                    f"Failed to bind authorization callback server to port {server_port}: {ex}"
                 )
                 raise
             except OSError as ex:
                 if attempt == self.DEFAULT_MAX_ATTEMPTS:
                     logger.error(
-                        f"Failed to bind authorization callback server to port {port}: {ex}"
+                        f"Failed to bind authorization callback server to port {server_port}: {ex}"
                     )
                     raise
                 logger.warning(
                     f"Attempt {attempt}/{self.DEFAULT_MAX_ATTEMPTS}. "
-                    f"Failed to bind authorization callback server to port {port}: {ex}"
+                    f"Failed to bind authorization callback server to port {server_port}: {ex}"
                 )
                 time.sleep(self.PORT_BIND_TIMEOUT / self.PORT_BIND_MAX_ATTEMPTS)
         try:
@@ -114,16 +120,47 @@ class AuthHttpServer:
             logger.error(f"Failed to start listening for auth callback: {ex}")
             self.close()
             raise
-        port = self._socket.getsockname()[1]
+
+        server_port = self._socket.getsockname()[1]
         self._uri = urllib.parse.ParseResult(
             scheme=parsed_uri.scheme,
-            netloc=parsed_uri.hostname + ":" + str(port),
+            netloc=parsed_uri.hostname + ":" + str(server_port),
             path=parsed_uri.path,
             params=parsed_uri.params,
             query=parsed_uri.query,
             fragment=parsed_uri.fragment,
         )
 
+        if parsed_redirect:
+            if (
+                self._is_local_uri(parsed_redirect)
+                and server_port != parsed_redirect.port
+            ):
+                logger.debug(
+                    f"Updating redirect port {parsed_redirect.port} to match the server port {server_port}."
+                )
+                self._redirect_uri = urllib.parse.ParseResult(
+                    scheme=parsed_redirect.scheme,
+                    netloc=parsed_redirect.hostname + ":" + str(server_port),
+                    path=parsed_redirect.path,
+                    params=parsed_redirect.params,
+                    query=parsed_redirect.query,
+                    fragment=parsed_redirect.fragment,
+                )
+            else:
+                self._redirect_uri = parsed_redirect
+        else:
+            # For backwards compatibility
+            self._redirect_uri = self._uri
+
+    @staticmethod
+    def _is_local_uri(uri):
+        return uri.hostname in ("localhost", "127.0.0.1")
+
+    @property
+    def redirect_uri(self) -> str | None:
+        return self._redirect_uri.geturl()
+
     @property
     def url(self) -> str:
         return self._uri.geturl()

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/_oauth_base.py

@@ -35,6 +35,14 @@ logger = logging.getLogger(__name__)
 
 
 class _OAuthTokensMixin:
+    """Manages OAuth token caching to avoid repeated browser authentication flows.
+
+    Access tokens: Short-lived (typically 10 minutes), cached to avoid immediate re-auth.
+    Refresh tokens: Long-lived (hours/days), used to obtain new access tokens silently.
+
+    Tokens are cached per (user, IDP host) to support multiple OAuth providers/accounts.
+    """
+
     def __init__(
         self,
         token_cache: TokenCache | None,
@@ -77,12 +85,18 @@ class _OAuthTokensMixin:
         return self._token_cache.retrieve(key)
 
     def _pop_cached_access_token(self) -> bool:
-        """Retrieves OAuth access token from the token cache if enabled"""
+        """Retrieves OAuth access token from the token cache if enabled, available and still valid.
+
+        Returns True if cached token found, allowing authentication to skip OAuth flow.
+        """
         self._access_token = self._pop_cached_token(self._get_access_token_cache_key())
         return self._access_token is not None
 
     def _pop_cached_refresh_token(self) -> bool:
-        """Retrieves OAuth refresh token from the token cache if enabled"""
+        """Retrieves OAuth refresh token from the token cache (if enabled) to silently obtain new access token.
+
+        Returns True if refresh token found, enabling automatic token renewal without user interaction.
+        """
         if self._refresh_token_enabled:
             self._refresh_token = self._pop_cached_token(
                 self._get_refresh_token_cache_key()

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/oauth_code.py

@@ -65,6 +65,7 @@ class AuthByOauthCode(AuthByOAuthBase):
         external_browser_timeout: int | None = None,
         enable_single_use_refresh_tokens: bool = False,
         connection: SnowflakeConnection | None = None,
+        uri: str | None = None,
         **kwargs,
     ) -> None:
         authentication_url, redirect_uri = self._validate_oauth_code_uris(
@@ -92,6 +93,7 @@ class AuthByOauthCode(AuthByOAuthBase):
         self._origin: str | None = None
         self._authentication_url = authentication_url
         self._redirect_uri = redirect_uri
+        self._uri = uri
         self._state = secrets.token_urlsafe(43)
         logger.debug("chose oauth state: %s", "".join("*" for _ in self._state))
         self._protocol = "http"
@@ -117,7 +119,10 @@ class AuthByOauthCode(AuthByOAuthBase):
     ) -> (str | None, str | None):
         """Web Browser based Authentication."""
         logger.debug("authenticating with OAuth authorization code flow")
-        with AuthHttpServer(self._redirect_uri) as callback_server:
+        with AuthHttpServer(
+            redirect_uri=self._redirect_uri,
+            uri=self._uri or self._redirect_uri,  # for backward compatibility
+        ) as callback_server:
             code = self._do_authorization_request(callback_server, conn)
             return self._do_token_request(code, callback_server, conn)
 
@@ -260,7 +265,7 @@ You can close this window now and go back where you started from.
         connection: SnowflakeConnection,
     ) -> str | None:
         authorization_request = self._construct_authorization_request(
-            callback_server.url
+            callback_server.redirect_uri
         )
         logger.debug("step 1: going to open authorization URL")
         print(
@@ -315,7 +320,7 @@ You can close this window now and go back where you started from.
         fields = {
             "grant_type": "authorization_code",
             "code": code,
-            "redirect_uri": callback_server.url,
+            "redirect_uri": callback_server.redirect_uri,
         }
         if self._enable_single_use_refresh_tokens:
             fields["enable_single_use_refresh_tokens"] = "true"

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/oauth_credentials.py

@@ -27,6 +27,7 @@ class AuthByOauthCredentials(AuthByOAuthBase):
         token_request_url: str,
         scope: str,
         connection: SnowflakeConnection | None = None,
+        credentials_in_body: bool = False,
         **kwargs,
     ) -> None:
         self._validate_client_credentials_present(client_id, client_secret, connection)
@@ -40,6 +41,7 @@ class AuthByOauthCredentials(AuthByOAuthBase):
             **kwargs,
         )
         self._application = application
+        self._credentials_in_body = credentials_in_body
         self._origin: str | None = None
 
     def _get_oauth_type_id(self) -> str:
@@ -60,4 +62,7 @@ class AuthByOauthCredentials(AuthByOAuthBase):
             "grant_type": "client_credentials",
             "scope": self._scope,
         }
+        if self._credentials_in_body:
+            fields["client_id"] = self._client_id
+            fields["client_secret"] = self._client_secret
         return self._get_request_token_response(conn, fields)

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/okta.py

@@ -166,6 +166,7 @@ class AuthByOkta(AuthByPlugin):
             conn._internal_application_name,
             conn._internal_application_version,
             conn._ocsp_mode(),
+            conn.cert_revocation_check_mode,
             conn.login_timeout,
             conn.network_timeout,
             conn.socket_timeout,

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/webbrowser.py

@@ -165,15 +165,26 @@ class AuthByWebBrowser(AuthByPlugin):
                 return
 
             print(
-                "Initiating login request with your identity provider. A "
-                "browser window should have opened for you to complete the "
-                "login. If you can't see it, check existing browser windows, "
-                "or your OS settings. Press CTRL+C to abort and try again..."
+                "Initiating login request with your identity provider. Press CTRL+C to abort and try again..."
             )
 
             logger.debug("step 2: open a browser")
             print(f"Going to open: {sso_url} to authenticate...")
-            if not self._webbrowser.open_new(sso_url):
+            browser_opened = self._webbrowser.open_new(sso_url)
+            if browser_opened:
+                print(
+                    "A browser window should have opened for you to complete the "
+                    "login. If you can't see it, check existing browser windows, "
+                    "or your OS settings."
+                )
+
+            if (
+                browser_opened
+                or os.getenv("SNOWFLAKE_AUTH_FORCE_SERVER", "False").lower() == "true"
+            ):
+                logger.debug("step 3: accept SAML token")
+                self._receive_saml_token(conn, socket_connection)
+            else:
                 print(
                     "We were unable to open a browser window for you, "
                     "please open the url above manually then paste the "
@@ -195,9 +206,6 @@ class AuthByWebBrowser(AuthByPlugin):
                         },
                     )
                     return
-            else:
-                logger.debug("step 3: accept SAML token")
-                self._receive_saml_token(conn, socket_connection)
         finally:
             socket_connection.close()
 
@@ -460,6 +468,7 @@ You can close this window now and go back where you started from.
             conn._internal_application_name,
             conn._internal_application_version,
             conn._ocsp_mode(),
+            conn.cert_revocation_check_mode,
             conn.login_timeout,
             conn.network_timeout,
             conn.socket_timeout,

{snowflake_connector_python-3.18.0 → snowflake_connector_python-4.1.0}/src/snowflake/connector/auth/workload_identity.py

@@ -55,12 +55,14 @@ class AuthByWorkloadIdentity(AuthByPlugin):
         provider: AttestationProvider | None = None,
         token: str | None = None,
         entra_resource: str | None = None,
+        impersonation_path: list[str] | None = None,
         **kwargs,
     ) -> None:
         super().__init__(**kwargs)
         self.provider = provider
         self.token = token
         self.entra_resource = entra_resource
+        self.impersonation_path = impersonation_path
 
         self.attestation: WorkloadIdentityAttestation | None = None
 
@@ -76,6 +78,9 @@ class AuthByWorkloadIdentity(AuthByPlugin):
             self.attestation
         ).value
         body["data"]["TOKEN"] = self.attestation.credential
+        body["data"].setdefault("CLIENT_ENVIRONMENT", {})[
+            "WORKLOAD_IDENTITY_IMPERSONATION_PATH_LENGTH"
+        ] = len(self.impersonation_path or [])
 
     def prepare(
         self, *, conn: SnowflakeConnection | None, **kwargs: typing.Any
@@ -85,6 +90,7 @@ class AuthByWorkloadIdentity(AuthByPlugin):
             self.provider,
             self.entra_resource,
             self.token,
+            self.impersonation_path,
             session_manager=(
                 conn._session_manager.clone(max_retries=0) if conn else None
             ),