One of the questions that gets asked by people first starting out with Trino is “why does it require HTTPS for enabling username AND passwords?”
This is debated quite a bit, but, if you think about how your username/password are sent over the network, and how often a plaintext string is easy to capture, providing an easy way for “bad folks” to get sensitive information needed to be dealt with early on.
And as we see in (near) daily headlines, a data breach happens more frequently as more people/devices get connected.
So the simplest way to deal with this issue… don’t allow people to send plaintext passwords in the first place! Realistically, modern applications are moving away from passwords over HTTP, as has been an industry norm for more than a decade.
“So help me setup Trino really quickly where I can use username/password and get up and running!”
First, you need to know how you want to identify a user.
Password file? LDAP? JSON Web Tokens (“JWT”)?
Password files are pretty simple to understand and configure, so we will start with that.
In short:
-
Generate a username and password using htpasswd tool and store the entries one per line
Password file authentication — Trino 422 Documentation -
Acquire an SSL certificate (PEM or JKS) for the coordinator
PEM files — Trino 422 Documentation
JKS files — Trino 422 Documentation -
Configure the coordinator to communicate over 8443 (instead of 8080, the default)
TLS and HTTPS — Trino 422 Documentation -
Configure your client application to use HTTPS
https://trino.io/docs/current/installation/jdbc.html#connection-parameters
NOTE: if you are using self-signed certificates, you might need to type in “thisisunsafe” into your web browser. (no quotes)
