add http-server.authentication.type=PASSWORD cause error

[s-amir]

I try to connect trino to LDAP , so in config.properties i add "http-server.authentication.type=PASSWORD" to authenticate users with LDAP
i also create password-authenticator.properties in /etc/password-authenticator.properties
but as I append "http-server.authentication.type=PASSWORD" in config.properties i get error :
Invalid configuration property with prefix '': file does not exist: etc/password-authenticator.properties (for class io.trino.server.security.PasswordAuthenticatorConfig.passwordAuthenticatorFiles[0].<list element>)

can anyone help

[hashhar]

What did you use to deploy? Docker image or tarball?

It seems you have placed the config file at /etc/password-authenticator.properties. If you re-read the docs you'll notice it says etc/password-authenticator.properties (note the lack of leading /) which means the path is relative to the Trino data directory. For the Docker image this means /etc/trino while in the tarball this means the same directory where you extracted Trino itself.

[hashhar]

See https://trino.io/docs/current/security/tls.html#secure-trino-directly for TLS in general. Self-signed certs are no different. You import then into a trust/keystore and follow the same steps.

However using self-signed instead of public certs or at-least using an internal CA is asking for a lot of pain.

[yogesh-kalkate]

@hashhar i update changes as you mentioned in previous reply now my application ask for authentication but I deployed it on cluster with 1 coordinator and 2 worker config , now issue is that worker pod was not coming up they showing following error
I used its official helm chart for deploy

Errors:

1. Invalid configuration property with prefix '': file does not exist: etc/password-authenticator.properties (for class io.trino.server.security.PasswordAuthenticatorConfig.passwordAuthenticatorFiles[0].)

I update in values.yaml like this I'm using password authentication

authenticationType: "PASSWORD"
query:
maxMemory: "8GB"
exchangeManager:
name: "filesystem"
baseDir: "/tmp/trino-local-file-system-exchange-manager"
workerExtraConfig: "internal-communication.shared-secret=test"
coordinatorExtraConfig: "internal-communication.shared-secret=test"

additionalConfigProperties:

• http-server.process-forwarded=true
• http-server.authentication.type=PASSWORD
• internal-communication.https.required=true
• internal-communication.shared-secret=test
• http-server.https.enabled=true

I tried with volume mount, secret as well

[hashhar]

As the error message says you don't have a password-authenticator.properties at all (or at the correct location). From the partial values you have shared it seems you don't define a config-map/mount for that file.

Please ask on #kubernetes on the Trino slack.

[yogesh-kalkate]

@hashhar But I mentioned this in a global section which is applicable for both workers and coordinator , currently my coordinator pod was running fine, this properties file was correctly located inside the coordinator container .

[hashhar]

then make the file available on workers too as the error suggests.