WIF auth support for C interface (#953)

Author: sfc-gh-ddas

cpp/lib/Authenticator.cpp

@@ -30,6 +30,7 @@
 #include <fstream>
 
 #include "snowflake/SF_CRTFunctionSafe.h"
+#include "snowflake/WifAttestation.hpp"
 
 #ifdef __APPLE__
 #include <CoreFoundation/CFBundle.h>
@@ -75,6 +76,10 @@ extern "C" {
     {
         return AUTH_PAT;
     }
+    if (strcasecmp(authenticator, SF_AUTHENTICATOR_WORKLOAD_IDENTITY) == 0)
+    {
+        return AUTH_WIF;
+    }
 
     if (strcasecmp(authenticator, "test") == 0)
     {
@@ -190,6 +195,46 @@ extern "C" {
               snowflake_cJSON_AddStringToObject(data, "TOKEN", conn->oauth_token);
           }
       }
+      if (AUTH_WIF == authenticator)
+      {
+          Snowflake::Client::AttestationConfig config;
+          
+          // Populate config from SF_CONNECT fields
+          if (conn->wif_provider) {
+              auto typeOpt = Snowflake::Client::attestationTypeFromString(conn->wif_provider);
+              if (typeOpt) {
+                  config.type = typeOpt;
+                  log_debug("Using explicit WIF provider: %s", conn->wif_provider);
+              } else {
+                  log_warn("Invalid WIF provider specified: %s, falling back to auto-detection", conn->wif_provider);
+              }
+          }
+          
+          if (conn->wif_token) {
+              config.token = std::string(conn->wif_token);
+              log_debug("Using explicit WIF token");
+          }
+          
+          if (conn->wif_azure_resource) {
+              config.snowflakeEntraResource = std::string(conn->wif_azure_resource);
+              log_debug("Using Azure resource: %s", conn->wif_azure_resource);
+          }
+          
+          if (auto attestationOpt = Snowflake::Client::createAttestation(config))
+          {
+              const Snowflake::Client::Attestation &attestation = attestationOpt.value();
+
+              snowflake_cJSON_DeleteItemFromObject(data, "AUTHENTICATOR");
+              snowflake_cJSON_DeleteItemFromObject(data, "TOKEN");
+
+              snowflake_cJSON_AddStringToObject(data, "AUTHENTICATOR", SF_AUTHENTICATOR_WORKLOAD_IDENTITY);
+              snowflake_cJSON_AddStringToObject(data, "TOKEN", attestation.credential.c_str());
+              snowflake_cJSON_AddStringToObject(data, "PROVIDER",
+                  Snowflake::Client::stringFromAttestationType(attestation.type));
+          } else {
+              log_error("Failed to create WIF attestation - not running in a supported cloud environment?");
+          }
+      }
 
       if (conn->sso_token)
       {
@@ -222,8 +267,6 @@ extern "C" {
       {
           ; // Do nothing
       }
-
-      return;
   }
 
   void auth_renew_json_body(SF_CONNECT * conn, cJSON* body)
@@ -246,8 +289,6 @@ extern "C" {
     {
       ; // Do nothing
     }
-
-    return;
   }
 
   void STDCALL auth_terminate(SF_CONNECT * conn)

include/snowflake/client.h

@@ -45,6 +45,11 @@ extern "C" {
  */
 #define SF_AUTHENTICATOR_PAT "programmatic_access_token"
 
+/**
+ * Workload Identity Federation authenticator
+ */
+#define SF_AUTHENTICATOR_WORKLOAD_IDENTITY "workload_identity"
+
  /**
  * Authenticator, SSO token
  */
@@ -321,7 +326,10 @@ typedef enum SF_ATTRIBUTE {
     SF_CON_CRL_ALLOW_NO_CRL,
     SF_CON_CRL_DISK_CACHING,
     SF_CON_CRL_MEMORY_CACHING,
-    SF_CON_CRL_DOWNLOAD_TIMEOUT
+    SF_CON_CRL_DOWNLOAD_TIMEOUT,
+    SF_CON_WIF_PROVIDER,
+    SF_CON_WIF_TOKEN,
+    SF_CON_WIF_AZURE_RESOURCE
 } SF_ATTRIBUTE;
 
 /**
@@ -500,6 +508,11 @@ typedef struct SF_CONNECT {
     //programmatic access token
     char *programmatic_access_token;
 
+    // WIF (Workload Identity Federation) configuration
+    char *wif_provider;
+    char *wif_token;
+    char *wif_azure_resource;
+
     // put get configurations
     sf_bool use_s3_regional_url;
     sf_bool put_use_urand_dev;

lib/authenticator.h

@@ -18,6 +18,7 @@ typedef enum authenticator_type
         AUTH_JWT,
         AUTH_USR_PWD_MFA,
         AUTH_PAT,
+        AUTH_WIF,
         AUTH_TEST,
         AUTH_UNSUPPORTED
     } AuthenticatorType;

lib/client.c

@@ -1083,6 +1083,10 @@ SF_CONNECT *STDCALL snowflake_init() {
         sf->disable_saml_url_check = SF_BOOLEAN_FALSE;
         sf->programmatic_access_token = NULL;
 
+        sf->wif_provider = NULL;
+        sf->wif_token = NULL;
+        sf->wif_azure_resource = NULL;
+
         sf->use_s3_regional_url = SF_BOOLEAN_FALSE;
         sf->put_use_urand_dev = SF_BOOLEAN_FALSE;
         sf->put_compress_level = SF_DEFAULT_PUT_COMPRESS_LEVEL;
@@ -1170,6 +1174,9 @@ SF_STATUS STDCALL snowflake_term(SF_CONNECT *sf) {
     SF_FREE(sf->proxy);
     SF_FREE(sf->no_proxy);
     SF_FREE(sf->oauth_token);
+    SF_FREE(sf->wif_provider);
+    SF_FREE(sf->wif_token);
+    SF_FREE(sf->wif_azure_resource);
     SF_FREE(sf);
 
     stopwatch_stop(&stopwatch);
@@ -1671,6 +1678,15 @@ SF_STATUS STDCALL snowflake_set_attribute(
         case SF_CON_DISABLE_STAGE_BIND:
           sf->stage_binding_disabled = value ? *((sf_bool*)value) : SF_BOOLEAN_FALSE;
           break;
+        case SF_CON_WIF_PROVIDER:
+            alloc_buffer_and_copy(&sf->wif_provider, value);
+            break;
+        case SF_CON_WIF_TOKEN:
+            alloc_buffer_and_copy(&sf->wif_token, value);
+            break;
+        case SF_CON_WIF_AZURE_RESOURCE:
+            alloc_buffer_and_copy(&sf->wif_azure_resource, value);
+            break;
         default:
             SET_SNOWFLAKE_ERROR(&sf->error, SF_STATUS_ERROR_BAD_ATTRIBUTE_TYPE,
                                 "Invalid attribute type",
@@ -1877,6 +1893,15 @@ SF_STATUS STDCALL snowflake_get_attribute(
         case SF_CON_CLIENT_STORE_TEMPORARY_CREDENTIAL:
             *value = &sf->client_store_temporary_credential;
             break;
+        case SF_CON_WIF_PROVIDER:
+            *value = sf->wif_provider;
+            break;
+        case SF_CON_WIF_TOKEN:
+            *value = sf->wif_token;
+            break;
+        case SF_CON_WIF_AZURE_RESOURCE:
+            *value = sf->wif_azure_resource;
+            break;
         default:
             SET_SNOWFLAKE_ERROR(&sf->error, SF_STATUS_ERROR_BAD_ATTRIBUTE_TYPE,
                                 "Invalid attribute type",

tests/test_auth/CMakeLists.txt

@@ -6,6 +6,7 @@ add_executable(
         test_okta.c
         test_external_browser.c
         test_mfa.c
+        test_wif.c
         test_runner.c
         auth_utils.c
         ../utils/test_setup.c

tests/test_auth/test_runner.c

@@ -11,6 +11,16 @@ extern void test_external_browser_successful_connection(void **state);
 extern void test_external_browser_mismatched_username(void **state);
 extern void test_external_browser_wrong_credentials(void **state);
 extern void test_mfa_totp_authentication(void **state);
+extern void test_aws_wif_authentication(void **state);
+extern void test_gcp_wif_authentication(void **state);
+extern void test_azure_wif_authentication(void **state);
+extern void test_wif_no_cloud_credentials(void **state);
+extern void test_wif_invalid_authenticator(void **state);
+extern void test_wif_valid_authenticator(void **state);
+extern void test_wif_multiple_connections(void **state);
+extern void test_wif_explicit_provider_integration(void **state);
+extern void test_wif_invalid_provider_fallback(void **state);
+extern void test_wif_get_attributes(void **state);
 
 
 int main(void) {
@@ -27,7 +37,17 @@ int main(void) {
             cmocka_unit_test(test_external_browser_successful_connection),
             cmocka_unit_test(test_external_browser_mismatched_username),
             cmocka_unit_test(test_external_browser_wrong_credentials),
-            cmocka_unit_test(test_mfa_totp_authentication)
+            cmocka_unit_test(test_mfa_totp_authentication),
+            cmocka_unit_test(test_aws_wif_authentication),
+            cmocka_unit_test(test_gcp_wif_authentication),
+            cmocka_unit_test(test_azure_wif_authentication),
+            cmocka_unit_test(test_wif_no_cloud_credentials),
+            cmocka_unit_test(test_wif_invalid_authenticator),
+            cmocka_unit_test(test_wif_valid_authenticator),
+            cmocka_unit_test(test_wif_multiple_connections),
+            cmocka_unit_test(test_wif_explicit_provider_integration),
+            cmocka_unit_test(test_wif_invalid_provider_fallback),
+            cmocka_unit_test(test_wif_get_attributes)
     };
     int ret = cmocka_run_group_tests(tests, NULL, NULL);
     snowflake_global_term();