stackabletech / stackabletech/trino-operator
Additional properties for LDAP authentication
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 63
- Forks
- 13
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 12
Description
Usecase:
Connect Trino with existing company LDAP
Only a certain group of users from the LDAP is allowed to authenticate. Adding a searchfilter requieres specific LDAP properties.
These include
- ldap.user-bind-pattern
- ldap.group-auth-pattern
As a workaround we created a config map and mounted this as podOverrides into the trino pod.
We used configOverrides as well.
apiVersion: v1
kind: ConfigMap
metadata:
name: trino-ldap-config
data:
ldap-password-ldap-auth.properties: |
ldap.allow-insecure=true
ldap.group-auth-pattern=(&(uid\=${USER}))
ldap.url=ldap\://my-host\:my-port
ldap.user-base-dn=xx\=people,ou\=xxxxx,ou\=xxx,dc\=xxxxx,dc\=xxx
password-authenticator.name=ldap
ldap.user-bind-pattern=uid\=${USER},ou\=people,ou\=xxxxxx,ou\=xxx,dc\=xxxxxxx,dc\=xxx
ldap.group-auth-pattern=(&(uid\=${USER})(memberOf\=cn\=xxxxx,ou\=xxxxxx,ou\=xxxxx,ou\=xxx,dc\=xxxxxxxx,dc\=xxx))
From the trino deployment:
configOverrides:
config.properties:
password-authenticator.config-files: /stackable/rwconfig/trino-users-password-file-auth.properties,/tmp/config/ldap-password-ldap-auth.properties
podOverrides:
spec:
containers:
- name: trino
volumeMounts:
- name: custom-ldap-config
mountPath: /tmp/config/ldap-password-ldap-auth.properties
subPath: ldap-password-ldap-auth.properties
volumes:
- name: custom-ldap-config
configMap:
name: trino-ldap-config
fyi: for the specific case we discovered that the bindCredentials is optional.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the operator handles the config.properties and podOverrides shown in the issue for Trino LDAP authentication. Compare that path with the requested ldap.user-bind-pattern and ldap.group-auth-pattern properties, and confirm how optional bind credentials should be handled. Done means the properties work without the documented ConfigMap workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, rust
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100