Helm Chart - how to add ldap to Password authenticator

[preetsindhal]

Password authenticator name is set to file if authenticationType is PASSWORD
https://github.com/trinodb/charts/blob/main/charts/trino/templates/configmap-coordinator.yaml#L95

How to change this from file to ldap

Thanks.

[zeddit]

@preetsindhal I am facing the same requirements, If you come up with any solution, could you please share it with me. great thanks.

[luhea]

I am facing the same requirements, If you come up with any solution, could you please share it with me. great thanks.

[luhea]

Hello,zeddit.I solve it and did not need to modify the helm chart。my solution is config multiple auth in Helm's coordinatorExtraConfig. for example: http-server.authentication.type=PASSWORD,password-authenticator.config-files=/opt/trino-auth/ldap.properties,/opt/trino-auth/password.properties. this way defect is you should config local passworld auth .

[suisenkotoba]

hi @luhea were you able to to configure the TLS as well? I use helm chart and try to add file based authentication, but my coordinator keeps getting error. but when I use TLS load balancer by setting http-server.process-forwarded=true the client will get error Error running command: javax.net.ssl.SSLException: Unsupported or unrecognized SSL message. It'd be great help if you can show me how to configure the TLS with helm chart, I've been stuck with this problem for days. thanks in advance

[zeddit]

@suisenkotoba http-server.process-forwarded=true make trino work in non-tls mode, so ldap-auth cannot be enabled.

[pilipyukaaa]

i have same issure, when i try to discover coordinator in k8s i need jks store wich need do have CN, but i cant issure certificate for service into k8s
problem for file i fixed by hardcode configs
{{- if eq .Values.server.config.authenticationType "PASSWORD" }}
password-authenticator.properties: |
password-authenticator.name=ldap
ldap.url=ldaps://your ldap:636
ldap.allow-insecure=true
ldap.user-bind-pattern=uid=${USER},cn=users
{{- if .Values.auth.groups }}
but you need to broke others templates
{{- if eq .Values.server.config.authenticationType "sPASSWORD" }} in secret.yml
{{- if eq .Values.server.config.authenticationType "ssPASSWORD" }} in deployment-coordinator.yml

[luhea]

you should configure it in coordinater and worker: http-server.process-forwarded=true and internal-communication.shared-secret=xxxxx

[y-popov]

That's quite an old discussion, but I had the same issue and was able to solve it without modifying helm chart or creating a custom docker image. That's for you, whoever you are from the future reading this.

Even though mainterners of the helm chart are not so keen adding support for LDAP, the chart itself is very well written and can pass a lot of custom configuration. In order for Trino to use LDAP for authentication, you need this configuration in your values.yaml

server:
  config:
    authenticationType: PASSWORD
  coordinatorExtraConfig: |
    password-authenticator.config-files=/etc/trino/ldap.properties

coordinator:
  additionalConfigFiles:
    ldap.properties: |
      password-authenticator.name=ldap
      ldap.url=ldap://<your-ldap-host>
      # ...other bits of ldap configuration you need, see https://trino.io/docs/current/security/ldap.html

That's it. You are likely to be required to set up TLS as well but I leave it as a homework for students if you haven't done this already.

As a bonus, you can have both file-based and LDAP-based authentication at the same time if you'd like. For this use

server:
  coordinatorExtraConfig: |
    password-authenticator.config-files=/etc/trino/password-authenticator.properties,/etc/trino/ldap.properties