Repository navigation
MFA Network Policy for Snowflake Evaluation #143
Description
Hi Spider2.0 Team,
Since the recent change in MFA policy for Snowflake, I'm having a difficult time running any evaluations as delegated user/password credentials are no longer valid for the containerised execution of Snowflake requests.
Many queries fail with the error:
Failed to authenticate: MFA authentication is required, but none of your current MFA methods are supported for programmatic authentication.
which is expected when I have no MFA methods set up. The easiest strategy would be to use a programmatic access token tied to my PARTICIPANT role, but to use a PAT we need a valid network policy which we currently do not have.
snowflake.connector.errors.DatabaseError: 250001 (08001): Failed to connect to DB: RSRSBDK-YDB67606.snowflakecomputing.com:443. Fail : Network policy is required.
Can I ask if you can either adjust the participant MFA requirements or set a network policy for PAT usage to bypass direct MFA requirements? I'm not sure if there are any other options, but I would ask if you can let me know what the best strategy would be to programmatically allowing evaluations again.
Thank you :)
Activity
rickyang1114 commentedon Oct 20, 2025
Same issue here. @tomscohere, any luck finding a solution? Thanks in advance!
lfy79001 commentedon Oct 22, 2025
Dear all,
We have also recently noticed this issue and are working on fixing it. Please complete the MFA (Multi-Factor Authentication) process.
If you encounter a situation where you cannot access Snowflake using your own credentials, please use the snowflake_credential.json file I sent you.
Additionally, we will update some examples in the next few days. Thank you for your interest in Spider 2.0!
{ "user": "spider2_public_account", "password": "Spider2PublicAccount!", "account": "RSRSBDK-YDB67606" }Remember, please still use your original account to access the web page!
Only when you encounter issues connecting to Snowflake via Python should you use this account.
pminhtam commentedon Nov 7, 2025
Hi,
I have already completed the MFA process. I was able to execute the snowflake query with my original account yesterday.
But now, I got the error :
How can I fix it?
Thanks
lfy79001 commentedon Nov 7, 2025
@pminhtam
Hi, please see https://github.com/xlang-ai/Spider2/blob/main/assets/Snowflake_Guideline.md
censhao commentedon Jan 23, 2026
Hi Spider2.0 Team,
I am experiencing persistent connection issues when running evaluations on Snowflake. I have strictly followed the suggestions in Issue #148 and the official documentation, but the authentication still fails.
Details of my attempts:
Using Public Account: I used the provided spider2_public_account credentials, but the script still returns: 250001 (08001): Failed to authenticate: MFA with TOTP is required.
Following Guidelines: I followed the Snowflake_Guideline.md carefully. However, programmatic access via Python is consistently blocked by MFA for both my personal and the public account.
SAML/Identity Provider Error: After some configuration adjustments, I also encountered: 390190 (08001): There was an error related to the SAML Identity Provider account parameter. Contact Snowflake support.
Environment:
Account Identifier: RSRSBDK-YDB67606
Task: SQL Evaluation (evaluation_suite)
Since we cannot manually enter TOTP passcodes during automated evaluation, the current security policy makes it impossible to complete the tasks.
Could you please advise on:
Can MFA be disabled for spider2_public_account to allow programmatic access?
Is Key-Pair Authentication supported? If so, can you grant us permissions to set RSA_PUBLIC_KEY for our users?
Is there a specific authenticator configuration (other than snowflake or externalbrowser) that we should use for the evaluation container?
Thank you for your support!
lautel commentedon Jan 27, 2026
I'm also facing the same issues described by @censhao
@lfy79001 the steps in Snowflake_Guideline.md don't work for me either because there's no such a button to "Generate new token" under the "Programmatic access token" section.
The Key-Pair Authentication seems like a good solution if we can get permissions to set RSA_PUBLIC_KEY to our user.