Frequently asked questions

Advanced

Installation

Where is the Posit Team Native App available?

The Posit Team Native App is available in any region where Snowflake offers Snowpark Container Services. The Snowflake documentation describes the set of supported regions and their limitations.

Do I need to run all Posit Team products?

No. The Posit Team Native App lets you choose which of the Posit products to install and manage. You need a license only for the products you choose to run. Additionally, your initial choice is not permanent. You can start with Workbench and then later add Connect.

Authentication

How can I reduce repeated Snowflake sign-in prompts?

Users authenticate with Snowflake in two places:

  • When opening a product URL. Posit Team runs several Snowpark Container Services (SPCS) ingress endpoints: the landing page and each product URL for Workbench, Connect, and Posit Package Manager. Each endpoint shows a Snowflake sign-in page where users select their identity provider before continuing.
  • During the OAuth flow. Workbench-managed credentials and Connect viewer integrations authorize through the standard Snowflake sign-in page.

Most organizations sign in to Snowflake with single sign-on (SSO) through an identity provider such as Okta, Microsoft Entra ID, or Ping Identity. Snowflake configures this SSO as a SAML2 security integration. If your account works this way, set the LOGIN_IDP_REDIRECT account parameter so Snowflake redirects users straight to your identity provider instead of showing its own sign-in page:

Snowsight UI
ALTER ACCOUNT SET LOGIN_IDP_REDIRECT = (
  DEFAULT = my_saml_integration,
  SPCS = my_saml_integration
);
  • SPCS redirects the ingress sign-in page shown when users open the landing page or a product URL. This removes the most common prompt for Posit Team users.
  • DEFAULT redirects the standard Snowflake sign-in page, including the OAuth authorization flow used by managed credentials, which users encounter less often.

Set either key on its own, or both. Setting LOGIN_IDP_REDIRECT replaces the entire mapping, so include every key you want to keep in each statement. The referenced security integration must exist and be enabled, and the command requires the ACCOUNTADMIN role. Keep a backup sign-in method, such as a password with multi-factor authentication (MFA), for at least one account administrator.

Back to top