gopidesupavan commented on code in PR #74591:
URL: https://github.com/apache/airflow/pull/74591#discussion_r4276730364
##########
providers/snowflake/src/airflow/providers/snowflake/hooks/snowflake.py:
##########
@@ -572,6 +576,13 @@ def _add_workload_identity_config(
if token_file_path:
conn_config["token_file_path"] = token_file_path
+ impersonation_path = self._get_field(extra_dict,
"workload_identity_impersonation_path")
+
+ if impersonation_path:
+ if isinstance(impersonation_path, str):
+ impersonation_path = [step.strip() for step in
impersonation_path.split(",") if step.strip()]
+ conn_config["workload_identity_impersonation_path"] =
impersonation_path
Review Comment:
I think this will break when it goes through SQLAlchemy. get_uri() /
get_sqlalchemy_engine() build the URL from _get_conn_params(), and
snowflake-sqlalchemy’s _url() just does str(v) on anything that isn’t a string.
So the list goes into the query string as ['arn:...', 'arn:...'], and the
connector gets one string back, not a list. get_conn() and Snowpark would be
fine, but anything going through the engine (get_df etc.) wouldn’t get the
impersonation chain.
Could we handle it the way private_key and session_parameters are handled?
Add it to the exclusion list in _conn_params_to_sqlalchemy_uri and pass it
through connect_args in get_sqlalchemy_engine:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
