Connection to Snowflake using TIBCO Spotfire connector fails with error "The specified authenticator and destination URL in Saml Assertion did not match, expected=XXXX, post back=/login/cert"

Connection to Snowflake using TIBCO Spotfire connector fails with error "The specified authenticator and destination URL in Saml Assertion did not match, expected=XXXX, post back=/login/cert"

When using TIBCO Spotfire Connector for Snowflake and Okta as authentication method, it may fail with the following error which can be seen in the snowflake_odbc_connection.log(log generated in Snowflake ODBC installation directory based on the Tracing level set in the DSN configuration.)
 

Sep 25 19:31:20 INFO  49080 ConnectionSettings::UpdateSettings: ----- exit -----
Sep 25 19:31:22 ERROR 49080 Connection::SQLDriverConnectW: [Snowflake][Snowflake] (35)
The specified authenticator and destination URL in Saml Assertion did not match, expected=XXXX, post back=/login/cert

The cause of this issue is either because of wrong snowflake destination url setup in application settings of okta or if multi factor authentication is enabled on okta. Above error is the example if SAML is choosen as sign on method. But same reasons apply if Sign on method is one of Secure web authentication or OpenID. If multi factor authentication is enabled for the users on Okta, snowflake requires using browser-based SSO i.e 'externalbrowser' as the authenticator. But TIBCO Spotfire connector for Snowflake only supports Native SSO for Okta which doesn't support MFA. After first authentication, as it redirects to the next authentication step instead of destination Snowflake URL, we see above error. 

To resolve this issue, 

1. Disable MFA on Okta for the Spotfire users. 
2. Make a rule to not trigger another authentication step when trying to access from that specific network i.e make internal network and Spotfire application as exception.

Doc: Accessing Data from Snowflake:

• https://docs.tibco.com/pub/sfire-analyst/10.3.0/doc/html/en-US/TIB_sfire-analyst_UsersGuide/connectors/snowflake/snowflake_accessing_data_from_snowflake.htm

Doc: Configuring DSN:

• https://docs.tibco.com/pub/sfire-analyst/10.3.0/doc/html/en-US/TIB_sfire-analyst_UsersGuide/connectors/drill/drill_using_dsns_to_create_connections.htm

External: Snowflake Document on using Okta

• https://docs.snowflake.net/manuals/user-guide/admin-security-fed-auth-use.html#native-sso-okta-only