Tested changing Basic Authentication for Snowflake to Key Pair in a Dev ADF branch but switched back to Basic afterwards and now we fail running pipelines with trigger this pipeline now (debug run works though)

JB 221 Reputation points
2026-08-07T14:29:45.78+00:00

We needed to test changing our Snowflake v2 linked service from Basic authentication to Key Pair authentication so we updated the Snowflake linked service to keypair, uploaded the .p8 file, and changed a global parameter (for username change) in a development branch. After testing was successful, we changed back to Basic as we are not ready to move forward with key pair yet. But now we can only run in Debug run even using the main branch. If we run a pipeline with the Trigger now option we fail with the below error.

In our ADF Dev, in a development branch, we:

  • Changed the Snowflake v2 Linked Service to use key pair authentication and uploaded the private key file in the linked service
  • Updated the Global parameter for the snowflake username
  • Tested connection, and ran an extract successfully
  • Checked main to see that no changes were made there
  • Changed the branch back to use Basic authentication for our Snowflake linked service and changed the global parameter back in the development branch.
  • Tested connection OK, but can only run using Debug mode runs both in the development branch and in the main branch.
  • Our production ADF is still running fine as we did not push branch changes.

Hoping for any help on how to get our ADF Dev to run using trigger now runs? Thank you!

Error:
Failed to execute script. Exception: ''Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Failed to open the database connection.,Source=Microsoft.DataTransfer.Connectors.GenericAdoNet,''Type=Apache.Arrow.Adbc.C.CAdbcDriverImporter+ImportedAdbcException,Message=[Snowflake] 390144 (08004): JWT token is invalid.  [some guid],Source=Apache.Arrow.Adbc,''

Azure Data Factory
Azure Data Factory

An Azure service for ingesting, preparing, and transforming data at scale.

Answer accepted by question author
Smaran Thoomu 35,870 Reputation points Microsoft External Staff Moderator
2026-08-09T06:19:41.0233333+00:00

Hi @JB
Thank you for the update and for confirming the result.

Based on your testing, it appears the issue was caused by a configuration discrepancy between the Git branch/main branch and the Live/published factory. Although the linked service had been reverted to Basic authentication in Git, the Live version was still using the previous Key Pair authentication configuration. This explains why Debug runs were successful while Trigger Now was failing with the Snowflake 390144 (08004): JWT token is invalid error.

Rerunning the last successful release synchronized the Dev factory with the expected configuration, and you confirmed that Trigger Now is now working successfully.

Regarding your question about whether the Key Pair configuration was published while working in a branch: based on the behavior observed, the Key Pair configuration was present in the Live factory even though it was no longer present in the Git/main branch. However, I would not conclude that uploading the .p8 private key by itself caused the change to be published. The important point is that the Live/published configuration retained the Key Pair settings, which caused the trigger execution to attempt JWT authentication.

Going forward, before testing a Trigger Now execution, we recommend checking the Live version of the linked service and global parameters to ensure they match the intended Git/main configuration and then publishing the required changes through the normal ADF CI/CD process.

Since redeploying the last successful release restored the expected configuration and Trigger Now is now successful, it appears the issue has been resolved.

If this resolves the issue from your side, please consider Accepting this answer so that it can also help others who may encounter a similar Git/Live configuration discrepancy.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-07T14:30:03.5933333+00:00

    Trigger now runs use the published/live version, while Debug runs use the current authoring branch. That matches the behavior being seen: the authoring version works, but the published/live version is still trying to use the Snowflake key-pair path, which is why the triggered run fails with JWT token is invalid.

    Use this recovery path in Dev:

    1. In the Dev factory, open the Snowflake V2 linked service in the branch that now has the reverted Basic authentication settings.
    2. Verify the linked service is truly back on Basic authentication:
      • authenticationType is Basic
      • user is the intended Snowflake login
      • password points to the correct current secret if Azure Key Vault is used
    3. Verify the global parameter used for the Snowflake username is also reverted to the expected value.
    4. Publish the changes to Live. This is the key step. If the revert only exists in the branch and was never published, Trigger now continues using the older live configuration.
    5. Run Trigger now again.

    If Trigger now still fails after publishing, check for a published dependency mismatch:

    1. Confirm the pipeline, linked service, dataset, and any referenced global parameter are all published together.
    2. Avoid a state where an old published pipeline calls a newer dependent resource or vice versa. Azure Data Factory documents that deployments can fail when an old parent resource calls a new dependent resource after a breaking change.
    3. If needed, republish all affected artifacts in Dev so the live version is internally consistent.

    For the Snowflake side, the error also aligns with key-pair/JWT authentication problems. If the live linked service is still using key pair anywhere, verify these items:

    1. The correct public key is assigned to the Snowflake user.
    2. The private key secret was not corrupted by portal entry; multiline private keys should be stored correctly.
    3. The private key is PKCS#8 PEM format.
    4. The passphrase matches the key, if used.
    5. The intended Snowflake user is the one configured in the published linked service.

    Important distinction for ADF behavior:

    • Debug checks the current branch state.
    • Trigger now checks the published/live state.

    So the most likely fix is to publish the reverted Basic-auth linked service and related parameter changes in Dev, then rerun the pipeline.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.