Acceldata
 ODP
Search documentation… ⌘K

Set up Trino SSL

SSL Requirement

  • If any authentication (Kerberos, LDAP) is enabled for Trino, SSL must also be enabled.
  • In Ambari, when Kerberos is enabled, the 'Enable SSL' option is automatically selected. Disabling SSL while using authentication will cause Trino services to fail at startup.
  • The SSL certificate must have a valid SubjectAlternativeName (SAN). The SSL certificates without a SAN are not supported.

SSL Setup

  • Must use either a passwordless .pem file or a .jks keystore with a password on all the trino nodes, readable by Trino user.
  • Configure SSL Keystore Path=<path to pem/keystore location>, this path must be the same for each trino server as shown below.

Preserved image

  • A Shared Key must be configured when SSL is enabled. You can generate it using below command.
openssl rand 64 | base64
Enter the generated key in the 'Shared Key' configuration field during Trino setup under Advanced trino-env.

Internal Node-to-Node SSL (Optional)

The internode SSL communication between the Coordinator and Worker nodes, can be enabled as per below steps, however there is a performance degradation and it is not recommended.

Requirement: All certificates must be imported into the JDK 23 cacerts truststore on each node.

The example command is as follows.

sudo keytool -importcert \
-trustcacerts \
-keystore /tmp/jdk-23/lib/security/cacerts \
-storepass changeit \
-alias trino-worker \
-file /etc/trino/worker.crt \
-noprompt

Kerberos Configuration

The kerberos properties are all auto configured in the Coordinator node’s config.properties.

The following properties are added in config.properties once security is identified as Kerberos.

http-server.authentication.type=KERBEROS
web-ui.authentication.type=KERBEROS
#http-server.authentication.krb5.service-name={{kerberos_service_name}}
## This line if you plan to use it through a HTTP connection and UI access via Knox
http-server.authentication.krb5.service-name=HTTP
http-server.authentication.krb5.principal-hostname={{hostname}}
http-server.authentication.krb5.keytab={{keytab}}
http.authentication.krb5.config=/etc/krb5.conf

LDAP Configuration

To configure or enable LDAP, the following two properties need to be configured under Advanced trino-ldap:

  • LDAP URL
  • LDAP User Bind Pattern String

Preserved image