Trino connector authentication

The connector authenticates to the Gravitino server with the same mechanisms as the Java client, configured in the Trino catalog file under the gravitino.client. prefix. The Datastrato Enterprise server accepts Basic and OAuth, so those are the two modes covered here. Without gravitino.client.authType the connector sends no credentials, and the server rejects its calls.

Quick start

The example connects the connector to a server that signs users in with OAuth, using a client registered at the identity provider the server trusts. The connector requests a token with the client credentials grant and sends it on every call.

Confirm the server accepts OAuth, as set up in How to authenticate.

Add the OAuth settings to the catalog file on the coordinator. The token request goes to serverUri joined with path.

etc/catalog/gravitino.properties
connector.name=gravitino
gravitino.uri=https://{gravitino_host}
gravitino.metalake={metalake}
gravitino.client.authType=oauth2
gravitino.client.oauth2.serverUri=https://{idp_host}
gravitino.client.oauth2.path={token_path}
gravitino.client.oauth2.credential={client_id}:{client_secret}
gravitino.client.oauth2.scope={scope}

Restart Trino and list the catalogs. The metalake's catalogs appear next to gravitino.
List catalogs through the connector
```
SHOW CATALOGS;
```
When only gravitino appears, the Trino server log shows whether the token request or the call to the server failed.

Basic authentication

Basic authentication sends a user name and password from the server's local user store. The server must have Basic authentication enabled. See How to authenticate for server-side setup.

etc/catalog/gravitino.properties
connector.name=gravitino
gravitino.metalake={metalake}
gravitino.uri=https://{gravitino_host}
gravitino.client.authType=basic
gravitino.client.basic.username={username}
gravitino.client.basic.password={password}

Property	Description	Default	Required
`gravitino.client.authType`	`basic`	(none)	Yes
`gravitino.client.basic.username`	User name in the local user store	(none)	Yes when `authType` is `basic`
`gravitino.client.basic.password`	Password for that user	(none)	Yes when `authType` is `basic`

OAuth authentication

The connector requests an access token from the identity provider with the client credentials grant and sends it on every call. The Quick start shows a complete catalog file. The identity provider must be reachable from the coordinator and every worker.

Property	Description	Default	Required
`gravitino.client.authType`	`oauth2`	(none)	Yes
`gravitino.client.oauth2.serverUri`	Base address of the identity provider	(none)	Yes when `authType` is `oauth2`
`gravitino.client.oauth2.path`	Token endpoint path, joined to `serverUri`	(none)	Yes when `authType` is `oauth2`
`gravitino.client.oauth2.credential`	Client credentials as `{client_id}:{client_secret}`	(none)	Yes when `authType` is `oauth2`
`gravitino.client.oauth2.scope`	Scope to request with the token	(none)	Yes when `authType` is `oauth2`

Session credential forwarding

Setting gravitino.client.session.forwardUser=true creates a dedicated Gravitino client per Trino session user, so each user appears in the Gravitino audit log instead of the shared connector identity. Session forwarding requires authType=oauth2.

With oauth2, the connector presents the caller's own access token to Gravitino, so the server authorizes the end user rather than a shared service identity. The Trino coordinator must place that token in the session extra-credential named by gravitino.client.session.userTokenCredentialKey, which defaults to token. Coordinators that can do this include Starburst Enterprise through http-server.authentication.type=DELEGATED-OAUTH2. Open-source Trino cannot forward the token yet.

etc/catalog/gravitino.properties
connector.name=gravitino
gravitino.metalake={metalake}
gravitino.uri=https://{gravitino_host}
gravitino.client.authType=oauth2
gravitino.client.oauth2.serverUri=https://{idp_host}
gravitino.client.oauth2.path={token_path}
gravitino.client.oauth2.credential={client_id}:{client_secret}
gravitino.client.oauth2.scope={scope}
gravitino.client.session.forwardUser=true

Property	Description	Default	Required
`gravitino.client.session.forwardUser`	When `true`, calls Gravitino as the Trino session user for each query	`false`	No
`gravitino.client.session.userTokenCredentialKey`	Session extra-credential holding the caller's OAuth access token	`token`	No
`gravitino.client.session.cache.maxSize`	Maximum number of per-user sessions kept in the cache	`500`	No
`gravitino.client.session.cache.expireAfterAccessSeconds`	Seconds before an idle per-user session is evicted from the cache	`3600`	No

Quick start​

Basic authentication​

OAuth authentication​

Session credential forwarding​

Related​

Quick start

Basic authentication

OAuth authentication

Session credential forwarding

Related