SNOW-2169830: Duplicate MFA requests in Duo Mobile when connecting

[AndrewRybka]

1. What version of .NET driver are you using?

   4.6.0 (also experienced in 4.5.0 and 4.4.1)

2. What operating system and processor architecture are you using?

   Windows 10, x64.

3. What version of .NET framework are you using?

   .NET Framework 4.8

4. What did you do?

using (var connection = new SnowflakeDbConnection())
{
    connection.ConnectionString = "ACCOUNT=<account>>;USER=<user>;PASSWORD=<password>;DB=TEST_DB;SCHEMA=EM_SANDBOX;WAREHOUSE=<warehouse>";

    await connection.OpenAsync();

    using (var command = connection.CreateCommand())
    {
        command.CommandText = "SELECT 1+1";
        await command.ExecuteScalarAsync();
    }
}

5. What did you expect to see?

   Two push notifications are sent to the Duo Mobile app when I attempt to open a connection. Only one notification is expected.

   This behavior does not occur when connecting using the ODBC driver or via the Python connector — in those cases, only a single Duo Mobile confirmation request is received.

6. Can you set logging to DEBUG and collect the logs?

   snowflake_dotnet.log

[sfc-gh-dszmolka]

hi @AndrewRybka thanks for raising this issue. Sorry i could not get to it sooner.

This behaviour seems to be be expected, in a way. .NET driver uses connection pooling by default with a built in pool manager, and this is already different from the other drivers you mentioned.
Per the connection pooling documentation the default minimum pool is 2, just the exact number of logins I see happening in the logs you kindly shared:

[2025-06-21 23:33:54,829] [1] [DEBUG] [Snowflake.Data.Core.Session.SessionPool] SessionPool - allowed to create 2 sessions, current pool size is 0 out of 10 [pool: account=<account>;user=<user>;db=<db>;schema=<schema>;warehouse=<warehouse>;]
..
[2025-06-21 23:33:55,026] [1] [DEBUG] [Snowflake.Data.Core.RestRequester] Executing:  POST https://<account>.snowflakecomputing.com/session/v1/login-request?warehouse=<warehouse>&databaseName=<db>&schemaName=<schema>&roleName=&requestId=8657f864-dc80-47ef-b08f-0a50cf543e40&request_guid=b855e727-0e27-4e85-b384-b2cb38597685 HTTP/1.1
[2025-06-21 23:33:55,031] [4] [DEBUG] [Snowflake.Data.Core.RestRequester] Executing:  POST https://<account>.snowflakecomputing.com/session/v1/login-request?warehouse=<warehouse>&databaseName=<db>&schemaName=<schema>&roleName=&requestId=d5e3818e-11e1-44cd-b082-23503d6efc91&request_guid=a2e7ed7c-555e-488c-9dd6-f8d7d221c55a HTTP/1.1

2 separate login-request (with 2 different request_id), which is 2 separate authentication for the user, which i suppose i expected to trigger 2 MFA flows too.

I see however this can be annoying too, getting too many auth prompts, so perhaps can you try considering either of the below?

• set MinPoolSize=1 so only 1 connection would be spawned
• (recommended approach, if you don't have any specific internal policy which would prohibit this) set up MFA token caching
  • ALLOW_CLIENT_MFA_CACHING docs
  • example integration test from this repo.

Hope this helps but let me know if you have further questions. For now, this doesn't seem to be a bug.

[AndrewRybka]

Hi @sfc-gh-dszmolka, thank you for looking into this.

Can you please elaborate why the driver tries to open two connections when the code opens only one?

ALLOW_CLIENT_MFA_CACHING is set to true for the account that was used to isolate the issue.

[sfc-gh-dszmolka]

The driver opens 2 connections to snowflake because it's the documented default behaviour of the built-in, enabled-by-default connection pool: MinPoolSize=2. Please see the documentation reference above.

It's good that ALLOW_CLIENT_MFA_CACHING is set to true on the Server side, that's half way there :) MFA token caching also needs to be enabled on the client (driver) side.
Could you please try adding CLIENT_REQUEST_MFA_TOKEN=TRUE to connection config and let me know if it works?

If it does then i'll add it to the credentials caching docs which unfortunately only seems to mention the config for SSO token cache.

[AndrewRybka]

Thanks for the explanation — I missed that the driver could open additional connections automatically.

Tried adding CLIENT_REQUEST_MFA_TOKEN=TRUE. Doesn't help. Got the following line in the log with both versions 4.6.0 and 4.7.0.

[2025-07-12 18:46:11,830] [1] [DEBUG] [Snowflake.Data.Core.SFSessionProperties] Property client_request_mfa_token not found ignored.

[sfc-gh-dszmolka]

Interesting. What authenticator you use in the connection string?
In the example you provided originally, there's no authenticator specified, which means the default snowflake type; username and password.

For MFA token caching, could you please try to use authenticator= username_password_mfa ? Alongside with

• CLIENT_REQUEST_MFA_TOKEN=TRUE on client side
• ALLOW_CLIENT_MFA_CACHING=TRUE on server side.

[AndrewRybka]

With authenticator=username_password_mfa it works as expected. Thank you!

But the log file still mentions that Property client_request_mfa_token not found ignored.

Taking into account that both client_request_mfa_token and username_password_mfa are not mentioned on this page, could you please confirm that these settings will be supported and work in the same way in the foreseeable future? I use the driver in a distributed software and would like to understand if it's OK to ship those options to customers, or if it's better to recommend that customers use other authorization methods for now.