Certificate authenticator#
Примечание
Ниже приведена оригинальная документация Trino. Скоро мы ее переведем на русский язык и дополним полезными примерами.
Trino supports TLS-based authentication with X509 certificates via a custom certificate authenticator that extracts the principal from a client certificate.
Implementation#
CertificateAuthenticatorFactory
is responsible for creating a
CertificateAuthenticator
instance. It also defines the name of this
authenticator which is used by the administrator in a Trino configuration.
CertificateAuthenticator
contains a single method, authenticate()
,
which authenticates the client certificate and returns a Principal
, which is then
authorized by the System access control.
The implementation of CertificateAuthenticatorFactory
must be wrapped
as a plugin and installed on the Trino cluster.
Configuration#
After a plugin that implements CertificateAuthenticatorFactory
has been
installed on the coordinator, it is configured using an
etc/certificate-authenticator.properties
file. All of the
properties other than certificate-authenticator.name
are specific to the
CertificateAuthenticatorFactory
implementation.
The certificate-authenticator.name
property is used by Trino to find a
registered CertificateAuthenticatorFactory
based on the name returned by
CertificateAuthenticatorFactory.getName()
. The remaining properties are
passed as a map to CertificateAuthenticatorFactory.create()
.
Example configuration file:
certificate-authenticator.name=custom
custom-property1=custom-value1
custom-property2=custom-value2
Additionally, the coordinator must be configured to use certificate authentication and have HTTPS enabled (or HTTPS forwarding enabled).