Skip to content

Add ECDSA key support for key-pair authentication#2744

Open
jesusmgg wants to merge 13 commits intosnowflakedb:mainfrom
datacoves:ecdsa-keypair-support
Open

Add ECDSA key support for key-pair authentication#2744
jesusmgg wants to merge 13 commits intosnowflakedb:mainfrom
datacoves:ecdsa-keypair-support

Conversation

@jesusmgg
Copy link
Copy Markdown

@jesusmgg jesusmgg commented Jan 23, 2026

  1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

    Fixes SNOW-3017609: Support ECDSA keys for key-pair authentication #2743

  2. Fill out the following pre-review checklist:

    • I am adding a new automated test(s) to verify correctness of my new code
    • I am adding new logging messages
    • I am adding a new telemetry message
    • I am modifying authorization mechanisms
    • I am adding new credentials
    • I am modifying OCSP code
    • I am adding a new dependency
  3. Please describe how your code solves the related issue.

    Adds ECDSA key support (ES256, ES384, ES512) for key-pair authentication.

    Snowflake server supports ECDSA keys, but the Python connector only accepted RSA. This change:

    • Accepts EllipticCurvePrivateKey in addition to RSAPrivateKey
    • Detects curve type (P-256, P-384, P-521) and selects the appropriate JWT algorithm
    • Raises a clear error for unsupported curves
  4. (Optional) PR for stored-proc connector:

    N/A

@jesusmgg jesusmgg requested a review from a team as a code owner January 23, 2026 17:50
@github-actions
Copy link
Copy Markdown

github-actions bot commented Jan 23, 2026

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@jesusmgg
Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@jesusmgg
Copy link
Copy Markdown
Author

recheck

@jesusmgg
Copy link
Copy Markdown
Author

Heads up: the CLA bot seems broken - returning "Repository was archived so is read-only" when saving signatures.

@jesusmgg
Copy link
Copy Markdown
Author

jesusmgg commented Feb 6, 2026

recheck

@jesusmgg
Copy link
Copy Markdown
Author

jesusmgg commented Feb 6, 2026

Bumping this, the CLA check is still failing. The bot confirmed the signature but the check stays red. @sfc-gh-dszmolka any chance someone could look into this?

@sfc-gh-turbaszek
Copy link
Copy Markdown
Contributor

@jesusmgg please add appropriate change log entry to DESCRIPTION.md

"""Key pair based authentication."""

ALGORITHM = "RS256"
ALG_RS256 = "RS256"
Copy link
Copy Markdown
Contributor

@sfc-gh-turbaszek sfc-gh-turbaszek Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renaming ALGORITHM to ALG_RS256 removes a public class constant, which is a breaking change for any downstream code referencing AuthByKeyPair.ALGORITHM. Consider preserving a backward-compatible alias:

ALGORITHM = ALG_RS256  # deprecated, kept for backward compatibility

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SNOW-3017609: Support ECDSA keys for key-pair authentication

2 participants