AWS Glue to Snowflake OAuth 2.0 Fails with “AUTHORIZATION_CODE grant type but missing Refresh Token or Auth Code”

Hi everyone,

We are trying to connect Snowflake to AWS Glue using Azure AD/Entra ID External OAuth.

The connection test in AWS Glue is successful, and an access token is automatically generated in AWS Secrets Manager. However, when we run the AWS Glue job, we receive the following error:

AccessDeniedException: Failed to refresh access token. AUTHORIZATION_CODE grant type but missing Refresh Token or Auth Code and Redirect Url.

Could someone please help us understand what configuration is missing and how we can resolve this issue?

1. Azure / Microsoft Entra ID Configuration

Resource App

We created a Resource App in Azure App Registration and configured:

1. Application Redirect URL
2. API scope: session:read-only

Client App

We then created a separate Client App in Azure App Registration and configured:

1. Web Redirect URLs for:
   • Snowflake
     • AWS Glue
     1. Created a Client Secret
     2. Added API permissions for the Resource App
     3. Added the required users who need access to AWS Glue and Snowflake

2. Snowflake Configuration

We created the following Snowflake security integration for Azure External OAuth:

CREATE OR REPLACE SECURITY INTEGRATION <integration_name>
TYPE = EXTERNAL_OAUTH
ENABLED = TRUE
EXTERNAL_OAUTH_TYPE = AZURE
EXTERNAL_OAUTH_ISSUER = 'https://sts.windows.net/<TENANT_ID>/'
EXTERNAL_OAUTH_JWS_KEYS_URL = 'https://login.microsoftonline.com/<TENANT_ID>/discovery/v2.0/keys'
EXTERNAL_OAUTH_AUDIENCE_LIST = (
  'api://<RESOURCE_APP_ID>'
)
EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'upn'
EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'LOGIN_NAME'
EXTERNAL_OAUTH_ANY_ROLE_MODE = 'ENABLE';

3. AWS Secrets Manager Configuration

In AWS Secrets Manager, we configured the following values:

USER_MANAGED_CLIENT_APPLICATION_CLIENT_SECRET = <Azure Client App Secret>
OAUTH_CLIENT_ID = <Azure Client App ID>
TOKEN_URL = https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token
SCOPE = api://<RESOURCE_APP_ID>/.default

4. AWS Glue Data Connection

We created a new Snowflake connection in AWS Glue with:

• Snowflake hostname: Snowflake account URL
• Port: 443
• Authentication type: OAuth 2.0
• Authorization URL:

https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize

• Token URL:

https://login.microsoftonline.com/<TENANT_ID>/oauth2/token

• Scope:

api://<RESOURCE_APP_ID>/session:read-only

We also configured the AWS IAM role with access to AWS Glue and AWS Secrets Manager.

5. Current Behavior

When we test the AWS Glue connection, the connection is successful.

An access token is also automatically generated and stored in AWS Secrets Manager.

However, when we actually run the AWS Glue job, the job fails with the following error:

Py4JJavaError - An error occurred while calling o291.getSource.

shaded.glue.snowflake.glue.spark.connector.exception.AccessDeniedException:
Failed to refresh access token.

AUTHORIZATION_CODE grant type but missing Refresh Token or Auth Code and Redirect Url.

(Service: Glue, Status Code: 400,
Request ID: 3da4fe4c-006d-493c-a448-3a4dc974c9fa)

The stack trace indicates that the failure occurs while AWS Glue/Snowflake is trying to refresh the OAuth access token:

TokenRefresh.refreshAccessTokenWithoutRetry
...
V1Wrapper.refreshTokensAndTransformParams
...
GlueContext.getSource

6. Questions

Could someone please clarify:

1. Why is AWS Glue trying to use the AUTHORIZATION_CODE grant type when we have configured a Client ID and Client Secret?
2. Does AWS Glue's Snowflake connection require a Refresh Token for this configuration?
3. Are the Redirect URLs required for the AWS Glue runtime, even though the connection test succeeds?
4. Should the Azure Client App be configured differently—for example, with a different OAuth flow or redirect URI?
5. Should we use a different grant type, token endpoint, or scope for AWS Glue?
6. Is the following configuration correct for AWS Glue + Snowflake + Azure External OAuth?

Azure Entra ID
    ↓
Client App
    ↓
Resource App
    ↓
AWS Glue OAuth 2.0 Connection
    ↓
Snowflake External OAuth

Most importantly, what configuration needs to be changed to prevent AWS Glue from attempting an Authorization Code token refresh without a Refresh Token/Auth Code?

Any guidance or working configuration example for AWS Glue → Snowflake using Azure Entra ID External OAuth would be greatly appreciated.

Thanks in advance!