removing the requirement to have a passphrase on a Snowflake key

CHANGELOG.md

@@ -10,6 +10,7 @@
 - Adding optional "sslmode" parameter for postgres ([#2152](https:/fishtown-analytics/dbt/issues/2152), [#2154](https:/fishtown-analytics/dbt/pull/2154))
 - Add support for `generate_database_name` macro ([#1695](https:/fishtown-analytics/dbt/issues/1695), [#2143](https:/fishtown-analytics/dbt/pull/2143))
 - Expand the search path for schema.yml (and by extension, the default docs path) to include macro-paths and analysis-paths (in addition to source-paths, data-paths, and snapshot-paths) ([#2155](https:/fishtown-analytics/dbt/issues/2155), [#2160](https:/fishtown-analytics/dbt/pull/2160))
+- Remove the requirement to have a passphrase when using Snowflake key pair authentication ([#1804](https:/fishtown-analytics/dbt/issues/1805), [#2164](https:/fishtown-analytics/dbt/pull/2164))
 
 ### Fixes
 - Fix issue where dbt did not give an error in the presence of duplicate doc names ([#2054](https:/fishtown-analytics/dbt/issues/2054), [#2080](https:/fishtown-analytics/dbt/pull/2080))
@@ -24,9 +25,9 @@
 Contributors:
  - [@bubbomb](https:/bubbomb) ([#2080](https:/fishtown-analytics/dbt/pull/2080))
  - [@sonac](https:/sonac) ([#2078](https:/fishtown-analytics/dbt/pull/2078))
+ - [@mhmcdonald](https:/mhmcdonald) ([#2164](https:/fishtown-analytics/dbt/pull/2164))
  - [@dholleran-lendico](https:/dholleran-lendico) ([#2154](https:/fishtown-analytics/dbt/pull/2154))
 
-
 ## dbt 0.16.0b1 (February 11, 2020)
 
 ### Breaking changes

plugins/snowflake/dbt/adapters/snowflake/connections.py

@@ -129,13 +129,18 @@ def _get_access_token(self) -> str:
 
  def _get_private_key(self):
  """Get Snowflake private key by path or None."""
- if not self.private_key_path or self.private_key_passphrase is None:
+ if not self.private_key_path:
  return None
 
+ if self.private_key_passphrase:
+ encoded_passphrase = self.private_key_passphrase.encode()
+ else:
+ encoded_passphrase = None
+
  with open(self.private_key_path, 'rb') as key:
  p_key = serialization.load_pem_private_key(
  key.read(),
- password=self.private_key_passphrase.encode(),
+ password=encoded_passphrase,
  backend=default_backend())
 
  return p_key.private_bytes(

test/unit/test_snowflake_adapter.py

@@ -355,3 +355,24 @@ def test_authenticator_private_key_authentication(self, mock_get_private_key):
  warehouse='test_warehouse', private_key='test_key',
  application='dbt')
  ])
+
+ @mock.patch('dbt.adapters.snowflake.SnowflakeCredentials._get_private_key', return_value='test_key')
+ def test_authenticator_private_key_authentication_no_passphrase(self, mock_get_private_key):
+ self.config.credentials = self.config.credentials.replace(
+ private_key_path='/tmp/test_key.p8',
+ private_key_passphrase=None,
+ )
+
+ self.adapter = SnowflakeAdapter(self.config)
+ conn = self.adapter.connections.set_connection_name(name='new_connection_with_new_config')
+
+ self.snowflake.assert_not_called()
+ conn.handle
+ self.snowflake.assert_has_calls([
+ mock.call(
+ account='test_account', autocommit=False,
+ client_session_keep_alive=False, database='test_database',
+ role=None, schema='public', user='test_user',
+ warehouse='test_warehouse', private_key='test_key',
+ application='dbt')
+ ])