Entra ID support and requirements for Snow Automation Platform
Snow Automation Platform supports authentication through Microsoft Entra ID using OpenID Connect. However, it does not support a cloud-only Entra ID environment. On-premises Active Directory must remain available for authorization, user resolution, and other platform functions.
This article describes the supported configuration and the Active Directory dependencies that apply to Snow Automation Platform 3.19.0.
Supported configuration
OpenID Connect authentication with Entra ID is supported when Snow Automation Platform is connected to an on-premises Active Directory environment.
Azure AD Connect and Active Directory are prerequisites for this configuration. Although a user may successfully authenticate through Entra ID, Snow Automation Platform still relies on Active Directory to determine the user’s identity, roles, and permissions.
Removing on-premises Active Directory will prevent the authorization process from completing successfully.
Version and protocol support
OpenID Connect support was introduced in Snow Automation Platform 3.9.2 and is available in version 3.19.0. Use the latest supported Snow Automation Platform version when configuring OpenID Connect.
Snow Automation Platform supports OpenID Connect, which is built on OAuth 2.0. The platform does not support SAML 2.0 or WS-Federation.
OpenID Connect support does not remove the requirement for on-premises Active Directory.
Active Directory dependencies
Several Snow Automation Platform functions depend on connectivity to on-premises Active Directory.
These dependencies include:
- Converting the identity received through OpenID Connect into a Windows identity
- Resolving roles and group membership through Windows security identifiers, or SIDs
- Retrieving user properties through LDAP
- Resolving user display names and Active Directory object GUIDs
- Supporting SQL Server connections that use Windows Integrated Authentication (SSPI)
Snow Automation Platform uses NetSqlAzMan for authorization. Roles are stored using Windows SIDs, and there is no built-in mapping between Entra ID groups and Snow Automation Platform roles.
These dependencies prevent a cloud-only Entra ID configuration from working without changes to the product.
User provisioning and access
Snow Automation Platform does not support SCIM user provisioning.
The platform uses Just-in-Time user creation. A user record is created when the user first signs in. This process still requires on-premises Active Directory to resolve information such as the user’s display name and Active Directory object GUID.
Successful authentication through Entra ID does not automatically grant access to Snow Automation Platform. The platform must still complete its Active Directory-based authorization process.
There is no configuration option that automatically grants access to all authenticated Entra ID users.
Changing the user lookup setting
Changing userLookupType from LDAP to DB does not remove the requirement for on-premises Active Directory.
This setting disables one LDAP lookup path, but other dependencies remain. These include Windows identity creation, SID-based authorization, and Active Directory property lookups.
Recommended configuration
When using Entra ID authentication with Snow Automation Platform 3.19.0, retain the on-premises Active Directory environment and Azure AD Connect.
A cloud-only Entra ID configuration is not supported.
