search

trinodb / trino

Official repository of Trino, the distributed SQL query engine for big data, formerly known as PrestoSQL (https://trino.io)
https://trino.io
Apache License 2.0
10.28k stars 2.96k forks source link

Does trino support Microsoft AAD authentication with Access Token? #22430

Open kachely26 opened 3 months ago

kachely26 commented 3 months ago

Hi Trino expert,

We have an issue for connecting Trino using microsoft AAD authentication. Since traditional username+password is not allowed, we need to use Microsoft authentication to get the access token to connect Trino. Is it possible?

sugibuchi commented 3 months ago

I recently created #22516 for the JDBC driver, https://github.com/trinodb/trino-python-client/issues/466 for the Python client, and https://github.com/starburstdata/dbt-trino/issues/413 for DBT.

The extensions I propose in these issues are more generic, but we have a motivation similar to yours. Our team needs to integrate Azure AD (Entra ID) based authentication in Trino.

Our goal includes authentication using managed identities. If we need to use service principals or managed identities to authenticate Trino clients, we must combine the extensions above with Trino's JWT authentication.

The current JWT authentication support in the Trino server perfectly works to authenticate clients with access tokens issued by Azure AD. However, the existing JWT authentication support on the client side (JDBC driver, Python client, and DBT adapter) is not enough to use tokens issued by Azure AD.

On the other hand, if you want to authenticate Trino clients running in local environments with AAD user accounts, Trino's OAuth2 authentication would be enough. Our team uses both.