I am considering adopting {skiLift}. I can connect to Snowflake via skiLift::dbConnect(), but I am prompted by RStudio to 'Please enter private key passphrase' each time. This stifles automation, and I do not see any way to include it within a connection function. With DBI::dbConnect(), I can pass PRIV_KEY_FILE_PWD as an argument. Is there an equivalent in {skiLift}, or another way to provide the private key passphrase automatically?
Hi, I'm the package developer and maintainer for skiLift & skiPatrol.
Thanks for finding and reporting this, I was able to reproduce, and this is a functionality gap that needs to be filled — there’s currently no way to pass a passphrase into skiLift::dbConnect() at all, so an encrypted private key prompts every time, not just once (the JWT is regenerated on each token refresh, not only at connect).
Workaround for now: decrypt the key to an unencrypted PEM and point private_key_path at that instead:
openssl pkcs8 -in encrypted_key.p8 -out unencrypted_key.p8 -nocrypt
Tradeoff/Risk: this is exactly what a passphrase exists to avoid, so only do it somewhere the unencrypted file is as protected as the encrypted one was (permissions, not committed, not shared) — maybe OK for unblocking automation temporarily in a secured environment.
The fix: the plan is to replace the authentication functionality provided within the skiLift and skiPatrol packages with the dedicated functionality already provided in snowflakeauth, which will be the common place where all Snowflake authentication requirements are maintained going forward. That should be in place before, and as part of the packages becoming available on CRAN in a month or so.