A company already authenticates its workforce through an external SAML 2.0 identity provider and wants Snowflake users to sign in through that provider, with the identity provider asserting who the user is rather than Snowflake validating a password. Which Snowflake configuration object connects Snowflake to that external identity provider for browser-based single sign-on?
- AA network policy listing the identity provider's IP ranges, so only logins originating from that provider's addresses are accepted.
- BA masking policy that maps each federated identity to a Snowflake role and hides the user's external credentials at login.
- CA security integration of type SAML2, which registers the external identity provider so Snowflake trusts its federated authentication assertions. Correct
- DA key-pair assignment that stores the identity provider's public key on each user so the provider can sign each login request.
Why A is wrong: A network policy filters source IP addresses and does nothing to establish trust in a provider's identity assertions, so it cannot deliver single sign-on.
Why B is wrong: Masking policies obfuscate column values at query time and have no connection to authentication, so they cannot federate sign-in to an external provider.
Why C is correct: A SAML2 security integration registers the provider's certificate and issuer so Snowflake trusts its assertions and redirects browser logins for single sign-on.
Why D is wrong: Key-pair authentication uses an RSA key on the Snowflake user for unattended access, not a browser redirect to an external SAML provider for single sign-on.