Trino connector authentication

Introduction

The Gravitino Trino connector supports authenticating to the Gravitino server using the same authentication mechanisms as the Gravitino Java client: Simple, Basic, OAuth, and Kerberos. Authentication is configured through the Trino connector properties file using the gravitino.client.* prefix.

If gravitino.client.authType is not set, the connector operates in no-authentication mode and connects to the Gravitino server without any credentials.

Datastrato Enterprise does not support the simple authenticator, so use Basic, OAuth, or Kerberos.

Basic authentication

Basic authentication uses HTTP Basic credentials against the Gravitino local user store. The Gravitino server must have Basic authentication enabled. See How to authenticate for server-side setup.

etc/catalog/gravitino.properties

connector.name=gravitino
gravitino.metalake=metalake
gravitino.uri=http://localhost:8090

# Basic authentication with local user store
gravitino.client.authType=basic
gravitino.client.basic.username=admin
gravitino.client.basic.password=YourSecureGravitinoPassword

Configuration properties:

Property	Description	Default value	Required
gravitino.client.authType	Authentication type: simple, basic, oauth2, or kerberos	(none)	Yes (to enable Basic)
gravitino.client.basic.username	Local user store username	(none)	Yes if authType is basic
gravitino.client.basic.password	Local user store password	(none)	Yes if authType is basic

OAuth authentication

OAuth authentication uses OAuth tokens to authenticate with the Gravitino server.

etc/catalog/gravitino.properties

connector.name=gravitino
gravitino.metalake=metalake
gravitino.uri=http://localhost:8090

# OAuth2 authentication
gravitino.client.authType=oauth2
gravitino.client.oauth2.serverUri=http://{oauth_host}:8080
gravitino.client.oauth2.credential=client_id:client_secret
gravitino.client.oauth2.path=oauth2/token
gravitino.client.oauth2.scope=gravitino

Configuration properties:

Property	Description	Default value	Required
gravitino.client.authType	Authentication type: simple, basic, oauth2, or kerberos	(none)	Yes (to enable OAuth)
gravitino.client.oauth2.serverUri	OAuth server URI	(none)	Yes if authType is oauth2
gravitino.client.oauth2.credential	OAuth credentials in format client_id:client_secret	(none)	Yes if authType is oauth2
gravitino.client.oauth2.path	OAuth token endpoint path	(none)	Yes if authType is oauth2
gravitino.client.oauth2.scope	OAuth scope	(none)	Yes if authType is oauth2

Kerberos authentication

Kerberos authentication uses Kerberos tickets to authenticate with the Gravitino server.

etc/catalog/gravitino.properties

connector.name=gravitino
gravitino.metalake=metalake
gravitino.uri=http://localhost:8090

# Kerberos authentication with keytab
gravitino.client.authType=kerberos
gravitino.client.kerberos.principal=user@REALM
gravitino.client.kerberos.keytabFilePath=/path/to/user.keytab

Configuration properties:

Property	Description	Default value	Required
gravitino.client.authType	Authentication type: simple, basic, oauth2, or kerberos	(none)	Yes (to enable Kerberos)
gravitino.client.kerberos.principal	Kerberos principal	(none)	Yes if authType is kerberos
gravitino.client.kerberos.keytabFilePath	Path to keytab file	(none)	No (uses ticket cache if not specified)

Example: connecting to OAuth-protected Gravitino server

This example shows how to configure the Trino connector to connect to a Gravitino server protected by OAuth authentication.

1. Configure Gravitino server with OAuth (through the chart's sign-in values; see Configure), then re-run the helm upgrade --install command:

   my-values.yaml

   gravitino:
     authenticators: oauth
     authenticator:
       oauth:
         serviceAudience: gravitino
         defaultSignKey: "{signing_key}"
         tokenPath: /oauth2/token
         serverUri: http://localhost:8177

2. Configure Trino connector

   etc/catalog/gravitino.properties

   connector.name=gravitino
   gravitino.metalake=my_metalake
   gravitino.uri=http://localhost:8090
   
   # OAuth2 authentication
   gravitino.client.authType=oauth2
   gravitino.client.oauth2.serverUri=http://localhost:8177
   gravitino.client.oauth2.credential=test:test
   gravitino.client.oauth2.path=oauth2/token
   gravitino.client.oauth2.scope=test

3. Verify the connection:

   List catalogs through the connector

   SHOW CATALOGS;

Session credential forwarding

Setting gravitino.client.session.forwardUser=true creates a dedicated Gravitino client per Trino session user, so each user is visible in the Gravitino audit log instead of the shared connector identity. Session forwarding works with authType=oauth2 and authType=simple, of which Enterprise accepts only oauth2.

With oauth2, the connector presents the caller's own access token to Gravitino, so the server authorizes the end user rather than a shared service identity. The Trino coordinator must place that token in the session extra-credential named by gravitino.client.session.userTokenCredentialKey, which defaults to token. Coordinators that can do this include Starburst Enterprise through http-server.authentication.type=DELEGATED-OAUTH2. Open-source Trino cannot forward the token yet.

etc/catalog/gravitino.properties

connector.name=gravitino
gravitino.metalake=metalake
gravitino.uri=http://localhost:8090

gravitino.client.authType=oauth2
gravitino.client.oauth2.serverUri=http://{oauth_host}:8080
gravitino.client.oauth2.credential=client_id:client_secret
gravitino.client.oauth2.path=oauth2/token
gravitino.client.oauth2.scope=gravitino
gravitino.client.session.forwardUser=true

Configuration properties:

Property	Description	Default value	Required
gravitino.client.session.forwardUser	When true, forwards the Trino session user to Gravitino per-query	false	No
gravitino.client.session.userTokenCredentialKey	Session extra-credential holding the caller's OAuth access token	token	No
gravitino.client.session.cache.maxSize	Maximum number of per-user sessions to keep in the cache	500	No
gravitino.client.session.cache.expireAfterAccessSeconds	Seconds before an idle per-user session is evicted from the cache	3600	No

Notes

• The Gravitino server must be configured with the corresponding authentication mechanism enabled.
• For OAuth authentication, ensure the OAuth server is accessible from the Trino coordinator and workers.
• For Kerberos authentication, ensure the Kerberos configuration is properly set up on all Trino nodes.
• Authentication configuration is passed through the gravitino.client.* prefix to the underlying Gravitino Java client.

Related

• Gravitino Server Authentication Configuration
• Local users and groups
• Trino Connector Configuration