342/security/ldap.html


<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta charset="utf-8" />
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  <meta name="lang:clipboard.copy" content="Copy to clipboard">
  <meta name="lang:clipboard.copied" content="Copied to clipboard">
  <meta name="lang:search.language" content="en">
  <meta name="lang:search.pipeline.stopwords" content="True">
  <meta name="lang:search.pipeline.trimmer" content="True">
  <meta name="lang:search.result.none" content="No matching documents">
  <meta name="lang:search.result.one" content="1 matching document">
  <meta name="lang:search.result.other" content="# matching documents">
  <meta name="lang:search.tokenizer" content="[\s\-]+">

  
    <link href="https://fonts.gstatic.com/" rel="preconnect" crossorigin>
    <link href="https://fonts.googleapis.com/css?family=Roboto+Mono:400,500,700|Roboto:300,400,400i,700&display=fallback" rel="stylesheet">

    <style>
      body,
      input {
        font-family: "Roboto", "Helvetica Neue", Helvetica, Arial, sans-serif
      }

      code,
      kbd,
      pre {
        font-family: "Roboto Mono", "Courier New", Courier, monospace
      }
    </style>
  

  <link rel="stylesheet" href="../_static/stylesheets/application.css"/>
  <link rel="stylesheet" href="../_static/stylesheets/application-palette.css"/>
  <link rel="stylesheet" href="../_static/stylesheets/application-fixes.css"/>
  
  <link rel="stylesheet" href="../_static/fonts/material-icons.css"/>
  
  <meta name="theme-color" content="2196f3">
  <script src="../_static/javascripts/modernizr.js"></script>
  
  
    <title>LDAP Authentication &#8212; Presto 342 Documentation</title>
    <link rel="stylesheet" href="../_static/material.css" type="text/css" />
    <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
    <link rel="stylesheet" type="text/css" href="../_static/presto.css" />
    <script id="documentation_options" data-url_root="../" src="../_static/documentation_options.js"></script>
    <script src="../_static/jquery.js"></script>
    <script src="../_static/underscore.js"></script>
    <script src="../_static/doctools.js"></script>
    <script src="../_static/language_data.js"></script>
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="next" title="Password File Authentication" href="password-file.html" />
    <link rel="prev" title="CLI Kerberos Authentication" href="cli.html" />
  
   
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-133457846-1"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-133457846-1');
    </script>
  </head>
  <body dir=ltr
        data-md-color-primary=blue-grey data-md-color-accent=light-blue>
  
  <svg class="md-svg">
    <defs data-children-count="0">
      
      <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448" viewBox="0 0 416 448" id="__github"><path fill="currentColor" d="M160 304q0 10-3.125 20.5t-10.75 19T128 352t-18.125-8.5-10.75-19T96 304t3.125-20.5 10.75-19T128 256t18.125 8.5 10.75 19T160 304zm160 0q0 10-3.125 20.5t-10.75 19T288 352t-18.125-8.5-10.75-19T256 304t3.125-20.5 10.75-19T288 256t18.125 8.5 10.75 19T320 304zm40 0q0-30-17.25-51T296 232q-10.25 0-48.75 5.25Q229.5 240 208 240t-39.25-2.75Q130.75 232 120 232q-29.5 0-46.75 21T56 304q0 22 8 38.375t20.25 25.75 30.5 15 35 7.375 37.25 1.75h42q20.5 0 37.25-1.75t35-7.375 30.5-15 20.25-25.75T360 304zm56-44q0 51.75-15.25 82.75-9.5 19.25-26.375 33.25t-35.25 21.5-42.5 11.875-42.875 5.5T212 416q-19.5 0-35.5-.75t-36.875-3.125-38.125-7.5-34.25-12.875T37 371.5t-21.5-28.75Q0 312 0 260q0-59.25 34-99-6.75-20.5-6.75-42.5 0-29 12.75-54.5 27 0 47.5 9.875t47.25 30.875Q171.5 96 212 96q37 0 70 8 26.25-20.5 46.75-30.25T376 64q12.75 25.5 12.75 54.5 0 21.75-6.75 42 34 40 34 99.5z"/></svg>
      
    </defs>
  </svg>
  
  <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer">
  <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search">
  <label class="md-overlay" data-md-component="overlay" for="__drawer"></label>
  <a href="#security/ldap" tabindex="1" class="md-skip"> Skip to content </a>
  <header class="md-header" data-md-component="header">
  <nav class="md-header-nav md-grid">
    <div class="md-flex navheader">
      <div class="md-flex__cell md-flex__cell--shrink">
        <a href="../index.html" title="Presto 342 Documentation"
           class="md-header-nav__button md-logo">
          
              <img src="../_static/presto.svg" height="26"
                   alt="Presto 342 Documentation logo">
          
        </a>
      </div>
      <div class="md-flex__cell md-flex__cell--shrink">
        <label class="md-icon md-icon--menu md-header-nav__button" for="__drawer"></label>
      </div>
      <div class="md-flex__cell md-flex__cell--stretch">
        <div class="md-flex__ellipsis md-header-nav__title" data-md-component="title">
          <span class="md-header-nav__topic">Presto 342 Documentation</span>
          <span class="md-header-nav__topic"> LDAP Authentication </span>
        </div>
      </div>
      <div class="md-flex__cell md-flex__cell--shrink">
        <label class="md-icon md-icon--search md-header-nav__button" for="__search"></label>
        
<div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" action="../search.html" method="GET" name="search">
      <input type="text" class="md-search__input" name="q" placeholder="Search"
             autocapitalize="off" autocomplete="off" spellcheck="false"
             data-md-component="query" data-md-state="active">
      <label class="md-icon md-search__icon" for="__search"></label>
      <button type="reset" class="md-icon md-search__icon" data-md-component="reset" tabindex="-1">
        &#xE5CD;
      </button>
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="result">
          <div class="md-search-result__meta">
            Type to start searching
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>

      </div>
      
        <div class="md-flex__cell md-flex__cell--shrink">
          <div class="md-header-nav__source">
            <a href="https://github.com/prestosql/presto" title="Go to repository" class="md-source" data-md-source="github">

    <div class="md-source__icon">
      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 24 24" width="28" height="28">
        <use xlink:href="#__github" width="24" height="24"></use>
      </svg>
    </div>
  
  <div class="md-source__repository">
    Presto
  </div>
</a>
          </div>
        </div>
      
      
  <script src="../_static/javascripts/version_dropdown.js"></script>
  <script>
    var json_loc = "../../versions.json",
        target_loc = "../../",
        text = "Versions";
    $( document ).ready( add_version_dropdown(json_loc, target_loc, text));
  </script>
  

    </div>
  </nav>
</header>

  
  <div class="md-container">
    
    
    <!-- empty -->
    <main class="md-main">
      <div class="md-main__inner md-grid" data-md-component="container">
        
          <div class="md-sidebar md-sidebar--primary" data-md-component="navigation">
            <div class="md-sidebar__scrollwrap">
              <div class="md-sidebar__inner">
                <nav class="md-nav md-nav--primary" data-md-level="0">
  <label class="md-nav__title md-nav__title--site" for="__drawer">
    <a href="../index.html" title="Presto 342 Documentation" class="md-nav__button md-logo">
      
        <img src="../_static/presto.svg" alt=" logo" width="48" height="48">
      
    </a>
    <a href="../index.html"
       title="Presto 342 Documentation">Presto 342 Documentation</a>
  </label>
    <div class="md-nav__source">
      <a href="https://github.com/prestosql/presto" title="Go to repository" class="md-source" data-md-source="github">

    <div class="md-source__icon">
      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 24 24" width="28" height="28">
        <use xlink:href="#__github" width="24" height="24"></use>
      </svg>
    </div>
  
  <div class="md-source__repository">
    Presto
  </div>
</a>
    </div>
  
  
  <ul class="md-nav__list">
    <li class="md-nav__item">
    
    
      <a href="../overview.html" class="md-nav__link">Overview</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../installation.html" class="md-nav__link">Installation</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../client.html" class="md-nav__link">Clients</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../security.html" class="md-nav__link">Security</a>
      <ul class="md-nav__list"> 
    <li class="md-nav__item">
    
    
      <a href="server.html" class="md-nav__link">Coordinator Kerberos Authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="cli.html" class="md-nav__link">CLI Kerberos Authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
    <input class="md-toggle md-nav__toggle" data-md-toggle="toc" type="checkbox" id="__toc">
    <label class="md-nav__link md-nav__link--active" for="__toc"> LDAP Authentication </label>
    
      <a href="#" class="md-nav__link md-nav__link--active">LDAP Authentication</a>
      
        
<nav class="md-nav md-nav--secondary">
    <label class="md-nav__title" for="__toc">Contents</label>
    <ul class="md-nav__list" data-md-scrollfix="">
        <li class="md-nav__item"><a href="#presto-server-configuration" class="md-nav__link">Presto Server Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#presto-coordinator-node-configuration" class="md-nav__link">Presto Coordinator Node Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#server-config-properties" class="md-nav__link">Server Config Properties</a>
        </li>
        <li class="md-nav__item"><a href="#password-authenticator-configuration" class="md-nav__link">Password Authenticator Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#active-directory" class="md-nav__link">Active Directory</a>
        </li>
        <li class="md-nav__item"><a href="#openldap" class="md-nav__link">OpenLDAP</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#authorization-based-on-ldap-group-membership" class="md-nav__link">Authorization based on LDAP Group Membership</a>
        </li>
        <li class="md-nav__item"><a href="#authorization-using-presto-ldap-service-user" class="md-nav__link">Authorization using Presto LDAP service user</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#id1" class="md-nav__link">Active Directory</a>
        </li>
        <li class="md-nav__item"><a href="#id2" class="md-nav__link">OpenLDAP</a>
        </li></ul>
            </nav>
        </li></ul>
            </nav>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#presto-cli" class="md-nav__link">Presto CLI</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#environment-configuration" class="md-nav__link">Environment Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#tls-configuration" class="md-nav__link">TLS Configuration</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#presto-cli-execution" class="md-nav__link">Presto CLI Execution</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#troubleshooting" class="md-nav__link">Troubleshooting</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#java-keystore-file-verification" class="md-nav__link">Java Keystore File Verification</a>
        </li>
        <li class="md-nav__item"><a href="#ssl-debugging-for-presto-cli" class="md-nav__link">SSL Debugging for Presto CLI</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#common-ssl-errors" class="md-nav__link">Common SSL errors</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#java-security-cert-certificateexception-no-subject-alternative-names-present" class="md-nav__link">java.security.cert.CertificateException: No subject alternative names present</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#authentication-or-ssl-errors-with-jdk-upgrade" class="md-nav__link">Authentication or SSL errors with JDK Upgrade</a>
        </li></ul>
            </nav>
        </li></ul>
            </nav>
        </li>
    </ul>
</nav>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="password-file.html" class="md-nav__link">Password File Authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="salesforce.html" class="md-nav__link">Salesforce Authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="user-mapping.html" class="md-nav__link">User Mapping</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="tls.html" class="md-nav__link">Java Keystores and Truststores</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="built-in-system-access-control.html" class="md-nav__link">Built-in System Access Control</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="internal-communication.html" class="md-nav__link">Secure Internal Communication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="secrets.html" class="md-nav__link">Secrets</a>
      
    
    </li></ul>
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../admin.html" class="md-nav__link">Administration</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../optimizer.html" class="md-nav__link">Query Optimizer</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../connector.html" class="md-nav__link">Connectors</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../functions.html" class="md-nav__link">Functions and Operators</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../language.html" class="md-nav__link">SQL Language</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../sql.html" class="md-nav__link">SQL Statement Syntax</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../migration.html" class="md-nav__link">Migration</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../develop.html" class="md-nav__link">Developer Guide</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../release.html" class="md-nav__link">Release Notes</a>
      
    
    </li>
  </ul>
  

</nav>
              </div>
            </div>
          </div>
          <div class="md-sidebar md-sidebar--secondary" data-md-component="toc">
            <div class="md-sidebar__scrollwrap">
              <div class="md-sidebar__inner">
                
<nav class="md-nav md-nav--secondary">
    <label class="md-nav__title" for="__toc">Contents</label>
    <ul class="md-nav__list" data-md-scrollfix="">
        <li class="md-nav__item"><a href="#presto-server-configuration" class="md-nav__link">Presto Server Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#presto-coordinator-node-configuration" class="md-nav__link">Presto Coordinator Node Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#server-config-properties" class="md-nav__link">Server Config Properties</a>
        </li>
        <li class="md-nav__item"><a href="#password-authenticator-configuration" class="md-nav__link">Password Authenticator Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#active-directory" class="md-nav__link">Active Directory</a>
        </li>
        <li class="md-nav__item"><a href="#openldap" class="md-nav__link">OpenLDAP</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#authorization-based-on-ldap-group-membership" class="md-nav__link">Authorization based on LDAP Group Membership</a>
        </li>
        <li class="md-nav__item"><a href="#authorization-using-presto-ldap-service-user" class="md-nav__link">Authorization using Presto LDAP service user</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#id1" class="md-nav__link">Active Directory</a>
        </li>
        <li class="md-nav__item"><a href="#id2" class="md-nav__link">OpenLDAP</a>
        </li></ul>
            </nav>
        </li></ul>
            </nav>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#presto-cli" class="md-nav__link">Presto CLI</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#environment-configuration" class="md-nav__link">Environment Configuration</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#tls-configuration" class="md-nav__link">TLS Configuration</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#presto-cli-execution" class="md-nav__link">Presto CLI Execution</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#troubleshooting" class="md-nav__link">Troubleshooting</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#java-keystore-file-verification" class="md-nav__link">Java Keystore File Verification</a>
        </li>
        <li class="md-nav__item"><a href="#ssl-debugging-for-presto-cli" class="md-nav__link">SSL Debugging for Presto CLI</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#common-ssl-errors" class="md-nav__link">Common SSL errors</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#java-security-cert-certificateexception-no-subject-alternative-names-present" class="md-nav__link">java.security.cert.CertificateException: No subject alternative names present</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#authentication-or-ssl-errors-with-jdk-upgrade" class="md-nav__link">Authentication or SSL errors with JDK Upgrade</a>
        </li></ul>
            </nav>
        </li></ul>
            </nav>
        </li>
    </ul>
</nav>
              </div>
            </div>
          </div>
        
        <div class="md-content">
          <article class="md-content__inner md-typeset" role="main">
            
  
<h1 id="security-ldap--page-root">LDAP Authentication<a class="headerlink" href="#security-ldap--page-root" title="Permalink to this headline">#</a></h1>
<p>Presto can be configured to enable frontend LDAP authentication over
HTTPS for clients, such as the <a class="reference internal" href="#cli-ldap"><span class="std std-ref">Presto CLI</span></a>, or the JDBC and ODBC
drivers. At present, only simple LDAP authentication mechanism involving
username and password is supported. The Presto client sends a username
and password to the coordinator, and the coordinator validates these
credentials using an external LDAP service.</p>
<p>To enable LDAP authentication for Presto, configuration changes are made on
the Presto coordinator. No changes are required to the worker configuration;
only the communication from the clients to the coordinator is authenticated.
However, if you want to secure the communication between
Presto nodes with SSL/TLS configure <a class="reference internal" href="internal-communication.html"><span class="doc">Secure Internal Communication</span></a>.</p>

<h2 id="presto-server-configuration">Presto Server Configuration<a class="headerlink" href="#presto-server-configuration" title="Permalink to this headline">#</a></h2>

<h3 id="presto-coordinator-node-configuration">Presto Coordinator Node Configuration<a class="headerlink" href="#presto-coordinator-node-configuration" title="Permalink to this headline">#</a></h3>
<p>Access to the Presto coordinator should be through HTTPS. You can do that
by creating a <a class="reference internal" href="tls.html#server-java-keystore"><span class="std std-ref">Java Keystore File for TLS</span></a> on the coordinator.</p>
<p>You also need to make changes to the Presto configuration files.
LDAP authentication is configured on the coordinator in two parts.
The first part is to enable HTTPS support and password authentication
in the coordinator’s <code class="docutils literal notranslate"><span class="pre">config.properties</span></code> file. The second part is
to configure LDAP as the password authenticator plugin.</p>

<h4 id="server-config-properties">Server Config Properties<a class="headerlink" href="#server-config-properties" title="Permalink to this headline">#</a></h4>
<p>The following is an example of the required properties that need to be added
to the coordinator’s <code class="docutils literal notranslate"><span class="pre">config.properties</span></code> file:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>http-server.authentication.type=PASSWORD

http-server.https.enabled=true
http-server.https.port=8443

http-server.https.keystore.path=/etc/presto_keystore.jks
http-server.https.keystore.key=keystore_password
</pre></div>
</div>
<table>
<colgroup>
<col style="width: 53%"/>
<col style="width: 47%"/>
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Property</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.authentication.type</span></code></p></td>
<td><p>Enable password authentication for the Presto
coordinator. Must be set to <code class="docutils literal notranslate"><span class="pre">PASSWORD</span></code>.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.https.enabled</span></code></p></td>
<td><p>Enables HTTPS access for the Presto coordinator.
Should be set to <code class="docutils literal notranslate"><span class="pre">true</span></code>. Default value is
<code class="docutils literal notranslate"><span class="pre">false</span></code>.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.https.port</span></code></p></td>
<td><p>HTTPS server port.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.https.keystore.path</span></code></p></td>
<td><p>The location of the Java Keystore file that will be
used to secure TLS.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.https.keystore.key</span></code></p></td>
<td><p>The password for the keystore. This must match the
password you specified when creating the keystore.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.process-forwarded</span></code></p></td>
<td><p>Enable treating forwarded HTTPS requests over HTTP
as secure.  Requires the <code class="docutils literal notranslate"><span class="pre">X-Forwarded-Proto</span></code> header
to be set to <code class="docutils literal notranslate"><span class="pre">https</span></code> on forwarded requests.
Default value is <code class="docutils literal notranslate"><span class="pre">false</span></code>.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.authentication.password.user-mapping.pattern</span></code></p></td>
<td><p>Regex to match against user.  If matched, user will be
replaced with first regex group. If not matched,
authentication is denied.  Default is <code class="docutils literal notranslate"><span class="pre">(.*)</span></code>.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">http-server.authentication.password.user-mapping.file</span></code></p></td>
<td><p>File containing rules for mapping user.  See
<a class="reference internal" href="user-mapping.html"><span class="doc">User Mapping</span></a> for more information.</p></td>
</tr>
</tbody>
</table>


<h4 id="password-authenticator-configuration">Password Authenticator Configuration<a class="headerlink" href="#password-authenticator-configuration" title="Permalink to this headline">#</a></h4>
<p>Password authentication needs to be configured to use LDAP. Create an
<code class="docutils literal notranslate"><span class="pre">etc/password-authenticator.properties</span></code> file on the coordinator. Example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>password-authenticator.name=ldap
ldap.url=ldaps://ldap-server:636
ldap.ssl-trust-certificate=/path/to/ldap_server.crt
ldap.user-bind-pattern=&lt;Refer below for usage&gt;
</pre></div>
</div>
<table>
<colgroup>
<col style="width: 50%"/>
<col style="width: 50%"/>
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Property</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.url</span></code></p></td>
<td><p>The URL to the LDAP server. The URL scheme must be
<code class="docutils literal notranslate"><span class="pre">ldap://</span></code> or <code class="docutils literal notranslate"><span class="pre">ldaps://</span></code>. Connecting to the LDAP
server without SSL enabled requires
<code class="docutils literal notranslate"><span class="pre">ldap.allow-insecure=true</span></code>.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.allow-insecure</span></code></p></td>
<td><p>Allow using an LDAP connection that is not secured with
TLS.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.ssl-trust-certificate</span></code></p></td>
<td><p>The path to the PEM encoded trust certificate  for the
LDAP server. This file should contain the LDAP
server’s certificate or its certificate authority.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.user-bind-pattern</span></code></p></td>
<td><p>This property can be used to specify the LDAP user
bind string for password authentication. This property
must contain the pattern <code class="docutils literal notranslate"><span class="pre">${USER}</span></code>, which is
replaced by the actual username during the password
authentication. Example: <code class="docutils literal notranslate"><span class="pre">${USER}@corp.example.com</span></code>.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.cache-ttl</span></code></p></td>
<td><p>LDAP cache duration. Defaults to <code class="docutils literal notranslate"><span class="pre">1h</span></code>.</p></td>
</tr>
</tbody>
</table>
<p>Based on the LDAP server implementation type, the property
<code class="docutils literal notranslate"><span class="pre">ldap.user-bind-pattern</span></code> can be used as described below.</p>

<h5 id="active-directory">Active Directory<a class="headerlink" href="#active-directory" title="Permalink to this headline">#</a></h5>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.user-bind-pattern=${USER}@&lt;domain_name_of_the_server&gt;
</pre></div>
</div>
<p>Example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.user-bind-pattern=${USER}@corp.example.com
</pre></div>
</div>


<h5 id="openldap">OpenLDAP<a class="headerlink" href="#openldap" title="Permalink to this headline">#</a></h5>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.user-bind-pattern=uid=${USER},&lt;distinguished_name_of_the_user&gt;
</pre></div>
</div>
<p>Example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.user-bind-pattern=uid=${USER},OU=America,DC=corp,DC=example,DC=com
</pre></div>
</div>


<h4 id="authorization-based-on-ldap-group-membership">Authorization based on LDAP Group Membership<a class="headerlink" href="#authorization-based-on-ldap-group-membership" title="Permalink to this headline">#</a></h4>
<p>You can further restrict the set of users allowed to connect to the Presto
coordinator, based on their group membership, by setting the optional
<code class="docutils literal notranslate"><span class="pre">ldap.group-auth-pattern</span></code> and <code class="docutils literal notranslate"><span class="pre">ldap.user-base-dn</span></code> properties, in addition
to the basic LDAP authentication properties.</p>
<table>
<colgroup>
<col style="width: 50%"/>
<col style="width: 50%"/>
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Property</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.user-base-dn</span></code></p></td>
<td><p>The base LDAP distinguished name for the user
who tries to connect to the server.
Example: <code class="docutils literal notranslate"><span class="pre">OU=America,DC=corp,DC=example,DC=com</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.group-auth-pattern</span></code></p></td>
<td><p>This property is used to specify the LDAP query for
the LDAP group membership authorization. This query
is executed against the LDAP server and if
successful, the user is authorized.
This property must contain a pattern <code class="docutils literal notranslate"><span class="pre">${USER}</span></code>,
which is replaced by the actual username in
the group authorization search query.
See samples below.</p></td>
</tr>
</tbody>
</table>
<p>Based on the LDAP server implementation type, the property
<code class="docutils literal notranslate"><span class="pre">ldap.group-auth-pattern</span></code> can be used as described below.</p>


<h4 id="authorization-using-presto-ldap-service-user">Authorization using Presto LDAP service user<a class="headerlink" href="#authorization-using-presto-ldap-service-user" title="Permalink to this headline">#</a></h4>
<p>Presto server can use dedicated LDAP service user for doing user group membership queries.
In such case Presto will first issue a group membership query for a Presto user that needs
to be authenticated. A user distinguished name will be extracted from a group membership
query result. Presto will then validate user password by creating LDAP context with
user distinguished name and user password. In order to use this mechanism <code class="docutils literal notranslate"><span class="pre">ldap.bind-dn</span></code>,
<code class="docutils literal notranslate"><span class="pre">ldap.bind-password</span></code> and <code class="docutils literal notranslate"><span class="pre">ldap.group-auth-pattern</span></code> properties need to be defined.</p>
<table>
<colgroup>
<col style="width: 50%"/>
<col style="width: 50%"/>
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Property</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.bind-dn</span></code></p></td>
<td><p>Bind distinguished name used by Presto when issuing
group membership queries.
Example: <code class="docutils literal notranslate"><span class="pre">CN=admin,OU=CITY_OU,OU=STATE_OU,DC=domain</span></code></p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.bind-password</span></code></p></td>
<td><p>Bind password used by Presto when issuing group
membership queries.
Example: <code class="docutils literal notranslate"><span class="pre">password1234</span></code></p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">ldap.group-auth-pattern</span></code></p></td>
<td><p>This property is used to specify the LDAP query for
the LDAP group membership authorization. This query
will be executed against the LDAP server and if
successful, a user distinguished name will be
extracted from a query result. Presto will then
validate user password by creating LDAP context with
user distinguished name and user password.</p></td>
</tr>
</tbody>
</table>

<h5 id="id1">Active Directory<a class="headerlink" href="#id1" title="Permalink to this headline">#</a></h5>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.group-auth-pattern=(&amp;(objectClass=&lt;objectclass_of_user&gt;)(sAMAccountName=${USER})(memberof=&lt;dn_of_the_authorized_group&gt;))
</pre></div>
</div>
<p>Example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.group-auth-pattern=(&amp;(objectClass=person)(sAMAccountName=${USER})(memberof=CN=AuthorizedGroup,OU=Asia,DC=corp,DC=example,DC=com))
</pre></div>
</div>


<h5 id="id2">OpenLDAP<a class="headerlink" href="#id2" title="Permalink to this headline">#</a></h5>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.group-auth-pattern=(&amp;(objectClass=&lt;objectclass_of_user&gt;)(uid=${USER})(memberof=&lt;dn_of_the_authorized_group&gt;))
</pre></div>
</div>
<p>Example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.group-auth-pattern=(&amp;(objectClass=inetOrgPerson)(uid=${USER})(memberof=CN=AuthorizedGroup,OU=Asia,DC=corp,DC=example,DC=com))
</pre></div>
</div>
<p>For OpenLDAP, for this query to work, make sure you enable the
<code class="docutils literal notranslate"><span class="pre">memberOf</span></code> <a class="reference external" href="http://www.openldap.org/doc/admin24/overlays.html">overlay</a>.</p>
<p>You can use this property for scenarios where you want to authorize a user
based on complex group authorization search queries. For example, if you want to
authorize a user belonging to any one of multiple groups (in OpenLDAP), this
property may be set as follows:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ldap.group-auth-pattern=(&amp;(|(memberOf=CN=normal_group,DC=corp,DC=com)(memberOf=CN=another_group,DC=com))(objectClass=inetOrgPerson)(uid=${USER}))
</pre></div>
</div>


<span id="cli-ldap"></span><h2 id="presto-cli">Presto CLI<a class="headerlink" href="#presto-cli" title="Permalink to this headline">#</a></h2>

<h3 id="environment-configuration">Environment Configuration<a class="headerlink" href="#environment-configuration" title="Permalink to this headline">#</a></h3>

<h4 id="tls-configuration">TLS Configuration<a class="headerlink" href="#tls-configuration" title="Permalink to this headline">#</a></h4>
<p>Access to the Presto coordinator should be through HTTPS when using LDAP
authentication. The Presto CLI can use either a <a class="reference internal" href="tls.html#server-java-keystore"><span class="std std-ref">Java Keystore</span></a> file or <a class="reference internal" href="tls.html#cli-java-truststore"><span class="std std-ref">Java Truststore</span></a>
for its TLS configuration.</p>
<p>If you are using a keystore file, it can be copied to the client machine and used
for its TLS configuration. If you are using truststore, you can either use
default Java truststores or create a custom truststore on the CLI. We do not
recommend using self-signed certificates in production.</p>


<h3 id="presto-cli-execution">Presto CLI Execution<a class="headerlink" href="#presto-cli-execution" title="Permalink to this headline">#</a></h3>
<p>In addition to the options that are required when connecting to a Presto
coordinator that does not require LDAP authentication, invoking the CLI
with LDAP support enabled requires a number of additional command line
options. You can either use <code class="docutils literal notranslate"><span class="pre">--keystore-*</span></code> or <code class="docutils literal notranslate"><span class="pre">--truststore-*</span></code> properties
to secure TLS connection. The simplest way to invoke the CLI is with a
wrapper script.</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>#!/bin/bash

./presto \
--server https://presto-coordinator.example.com:8443 \
--keystore-path /tmp/presto.jks \
--keystore-password password \
--truststore-path /tmp/presto_truststore.jks \
--truststore-password password \
--catalog &lt;catalog&gt; \
--schema &lt;schema&gt; \
--user &lt;LDAP user&gt; \
--password
</pre></div>
</div>
<table>
<colgroup>
<col style="width: 30%"/>
<col style="width: 70%"/>
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Option</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">--server</span></code></p></td>
<td><p>The address and port of the Presto coordinator.  The port must
be set to the port the Presto coordinator is listening for HTTPS
connections on. Presto CLI does not support using <code class="docutils literal notranslate"><span class="pre">http</span></code> scheme for
the URL when using LDAP authentication.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">--keystore-path</span></code></p></td>
<td><p>The location of the Java Keystore file that will be used
to secure TLS.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">--keystore-password</span></code></p></td>
<td><p>The password for the keystore. This must match the
password you specified when creating the keystore.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">--truststore-path</span></code></p></td>
<td><p>The location of the Java Truststore file that will be used
to secure TLS.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">--truststore-password</span></code></p></td>
<td><p>The password for the truststore. This must match the
password you specified when creating the truststore.</p></td>
</tr>
<tr class="row-odd"><td><p><code class="docutils literal notranslate"><span class="pre">--user</span></code></p></td>
<td><p>The LDAP username. For Active Directory this should be your
<code class="docutils literal notranslate"><span class="pre">sAMAccountName</span></code> and for OpenLDAP this should be the <code class="docutils literal notranslate"><span class="pre">uid</span></code> of
the user. This is the username which is
used to replace the <code class="docutils literal notranslate"><span class="pre">${USER}</span></code> placeholder pattern in the properties
specified in <code class="docutils literal notranslate"><span class="pre">config.properties</span></code>.</p></td>
</tr>
<tr class="row-even"><td><p><code class="docutils literal notranslate"><span class="pre">--password</span></code></p></td>
<td><p>Prompts for a password for the <code class="docutils literal notranslate"><span class="pre">user</span></code>.</p></td>
</tr>
</tbody>
</table>


<h2 id="troubleshooting">Troubleshooting<a class="headerlink" href="#troubleshooting" title="Permalink to this headline">#</a></h2>

<h3 id="java-keystore-file-verification">Java Keystore File Verification<a class="headerlink" href="#java-keystore-file-verification" title="Permalink to this headline">#</a></h3>
<p>Verify the password for a keystore file and view its contents using
<a class="reference internal" href="tls.html#troubleshooting-keystore"><span class="std std-ref">Java Keystore File Verification</span></a>.</p>


<h3 id="ssl-debugging-for-presto-cli">SSL Debugging for Presto CLI<a class="headerlink" href="#ssl-debugging-for-presto-cli" title="Permalink to this headline">#</a></h3>
<p>If you encounter any SSL related errors when running Presto CLI, you can run CLI using <code class="docutils literal notranslate"><span class="pre">-Djavax.net.debug=ssl</span></code>
parameter for debugging. You should use the Presto CLI executable jar to enable this. E.g.:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>java -Djavax.net.debug=ssl \
-jar \
presto-cli-&lt;version&gt;-executable.jar \
--server https://coordinator:8443 \
&lt;other_cli_arguments&gt;
</pre></div>
</div>

<h4 id="common-ssl-errors">Common SSL errors<a class="headerlink" href="#common-ssl-errors" title="Permalink to this headline">#</a></h4>

<h5 id="java-security-cert-certificateexception-no-subject-alternative-names-present">java.security.cert.CertificateException: No subject alternative names present<a class="headerlink" href="#java-security-cert-certificateexception-no-subject-alternative-names-present" title="Permalink to this headline">#</a></h5>
<p>This error is seen when the Presto coordinator’s certificate is invalid, and does not have the IP you provide
in the <code class="docutils literal notranslate"><span class="pre">--server</span></code> argument of the CLI. You have to regenerate the coordinator’s SSL certificate
with the appropriate <abbr title="Subject Alternative Name">SAN</abbr> added.</p>
<p>Adding a SAN to this certificate is required in cases where <code class="docutils literal notranslate"><span class="pre">https://</span></code> uses IP address in the URL, rather
than the domain contained in the coordinator’s certificate, and the certificate does not contain the
<abbr title="Subject Alternative Name">SAN</abbr> parameter with the matching IP address as an alternative attribute.</p>


<h4 id="authentication-or-ssl-errors-with-jdk-upgrade">Authentication or SSL errors with JDK Upgrade<a class="headerlink" href="#authentication-or-ssl-errors-with-jdk-upgrade" title="Permalink to this headline">#</a></h4>
<p>Starting with the JDK 8u181 release, to improve the robustness of LDAPS
(secure LDAP over TLS) connections, endpoint identification algorithms have
been enabled by default. See release notes
<a class="reference external" href="https://www.oracle.com/technetwork/java/javase/8u181-relnotes-4479407.html#JDK-8200666.">from Oracle</a>.
The same LDAP server certificate on the Presto coordinator, running on JDK
version &gt;= 8u181, that was previously able to successfully connect to an
LDAPS server, may now fail with the below error:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>javax.naming.CommunicationException: simple bind failed: ldapserver:636
[Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching ldapserver found.]
</pre></div>
</div>
<p>If you want to temporarily disable endpoint identification, you can add the
property <code class="docutils literal notranslate"><span class="pre">-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true</span></code>
to Presto’s <code class="docutils literal notranslate"><span class="pre">jvm.config</span></code> file. However, in a production environment, we
suggest fixing the issue by regenerating the LDAP server certificate so that
the certificate <abbr title="Subject Alternative Name">SAN</abbr> or certificate subject
name matches the LDAP server.</p>


          </article>
        </div>
      </div>
    </main>
  </div>
  <footer class="md-footer">
    <div class="md-footer-nav">
      <nav class="md-footer-nav__inner md-grid">
          
            <a href="cli.html" title="CLI Kerberos Authentication"
               class="md-flex md-footer-nav__link md-footer-nav__link--prev"
               rel="prev">
              <div class="md-flex__cell md-flex__cell--shrink">
                <i class="md-icon md-icon--arrow-back md-footer-nav__button"></i>
              </div>
              <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title">
                <span class="md-flex__ellipsis">
                  <span
                      class="md-footer-nav__direction"> Previous </span> CLI Kerberos Authentication </span>
              </div>
            </a>
          
          
            <a href="password-file.html" title="Password File Authentication"
               class="md-flex md-footer-nav__link md-footer-nav__link--next"
               rel="next">
            <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title"><span
                class="md-flex__ellipsis"> <span
                class="md-footer-nav__direction"> Next </span> Password File Authentication </span>
            </div>
            <div class="md-flex__cell md-flex__cell--shrink"><i
                class="md-icon md-icon--arrow-forward md-footer-nav__button"></i>
            </div>
          
        </a>
        
      </nav>
    </div>
    <div class="md-footer-meta md-typeset">
      <div class="md-footer-meta__inner md-grid">
        <div class="md-footer-copyright">
        </div>
      </div>
    </div>
  </footer>
  <script src="../_static/javascripts/application.js"></script>
  <script>app.initialize({version: "1.0.4", url: {base: ".."}})</script>
  </body>
</html>