Multiple Duo authentication requests during terraform plan

[hahuang65]

Provider Version

0.75.0

Terraform Version

1.5.7

Describe the bug

Using SNOWFLAKE_USER, SNOWFLAKE_PASSWORD, SNOWFLAKE_AUTHENTICATOR=UsernamePasswordMFA, SNOWFLAKE_CLIENT_STORE_TEMPORARY_CREDENTIAL=1 and SNOWFLAKE_CLIENT_REQUEST_MFA_TOKEN=1 results in Duo pushes for every single request made by Terraform.

I've also tried setting "true" instead of 1 for the boolean options as well.

Expected behavior

Should request a single time and cache it for the remainder of terraform plan or terraform run.

Code samples and commands

Please add code examples and commands that were run to cause the problem.

Additional context

Add any other context about the problem here.

[afeld]

I think #2504 (comment) may explain why this is happening.

[afeld]

Do you have MFA caching enabled on the Snowflake side?

[JESCHO99]

@sfc-gh-jcieslak What is the current status for this bug? What I see and testend in version 0.92.0 is that even with the "ALLOW_CLIENT_MFA_CACHING" set to true for the account every terraform plan using the same username and password is sending a duo push which makes it very hard to work good localy.

Also when having this parameter set explicitly it is not working in the provider:
client_request_mfa_token = true

[sfc-gh-asawicki]

Hey @JESCHO99. Which OS you are working on?

[JESCHO99]

Hey @sfc-gh-asawicki, we are working on Windows.

[sfc-gh-asawicki]

Okay, that's a lead.

AFAIK the caching works on macos and linux distros. The caching needs the CGO_ENABLED for the macos and windows builds. Apparently, the current build setup is not linking the required c libs correctly for windows builds. A fix will require a ground-up rework of our release pipelines or finding a workaround solution for windows builds.

We will follow up with the problem internally but for now, we can suggest only:

• using a different OS if possible (you can check Connection Caching For External Browser Auth #1700 and Token Caching does not work #2047 we got several confirmations for problem being solved on other distros)
• building the custom version of the provider on windows directly (it should help with the linking problem)

cc: @sfc-gh-sthyagaraj

[JESCHO99]

Hey @sfc-gh-asawicki, thanks for pointing out what is not working here and delivering some workarounds. I guess when this is solved this issue ticket will be closed? So we will just keep watching. Thanks for your help!

[sfc-gh-asawicki]

Yes, we will update you on this issue as soon as we make any progress with the caching problems. In the meantime, please inform us if you try any of these workarounds or when you come up with something different (it might be helpful).