Support for JWT Authentication #110

kamalkang-hpe · 2024-04-21T22:26:06Z

Added support for JWT Authentication

Added support for JWT Authentication
Added Unit and Integration tests

cla-bot · 2024-04-21T22:26:09Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

nineinchnick · 2024-04-22T08:00:45Z

trino/trino.go

@@ -249,6 +252,7 @@ func (c *Config) FormatDSN() (string, error) {
 		"session_properties": strings.Join(sessionkv, ","),
 		"extra_credentials":  strings.Join(credkv, ","),
 		"custom_client":      c.CustomClientName,
+		"bearer_auth":        c.BearerAuth,


Can this be called accessToken, as in the JDBC driver? Also rename the config struct property.

Reference: https://trino.io/docs/current/client/jdbc.html#parameter-reference

@nineinchnick - Sure, I can fix that.

@nineinchnick - Fixed it. Please check.

nineinchnick · 2024-04-22T08:02:26Z

trino/etc/secrets/generate_jwt.py

+# Generate JWT token
+token = jwt.encode(payload, private_key, algorithm='RS256')
+
+print(token) 


When this should be used? Maybe mention it in the README or test docs. Can this be a Go program?

@nineinchnick - This is the code I used to generate the token. I can change to Go and I will add README.

@nineinchnick -

Added README

Removed not used secret files

Added Go based JWT token generator

Increase expiry time for certificate/token

trino/etc/secrets/certificate_with_key.pem

nineinchnick · 2024-04-22T08:04:00Z

trino/etc/secrets/jwt_token

@@ -0,0 +1 @@
+eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0IiwiZXhwIjo0ODY3MjQ4MzY1fQ.a8O5YhYSn1WNedLqAYq8e5lXSwOkabZjhvKIAXPEGBc5juYBgnWcfad4kXn4PCoD6ykcmGACRuMiBNGbQMxPy6iX5vNie8tX-P-GuXhgHuRIcf6deVOibGb9RHaS0VwtwsgBZREhxF9-410db0k5qwipVJKu-t8mttvgIRhx2hyRaXigH2IT1W3Q06K3o81Olq-c_b4qF1oVpVEuQ7uzPUXb5LVK30YVBcUtFHtlYQX0ZJ_5hCTI37l5krBGIt--WOGs368tVrUPDLyhdEW2V7dN_NnPwfGuxzBVRTgC8oqGNlbOWSouUYrfW3gN6LYEckBfXGbk5daNQ5u0OmYkgg


How long is this valid for? Can it be valid for a really long time, so we never have to regenerate it?

@nineinchnick - Valid for 100 years.

nineinchnick · 2024-04-22T08:05:04Z

trino/integration_test.go

+				Repository:   "trinodb/trino",
+				Tag:          *trinoImageTagFlag,
+				Mounts:       []string{wd + "/etc:/etc/trino"},
+				ExposedPorts: exposedPorts,


Why do we need to expose ports? This will cause conflicts if anything already uses these ports (other containers).

@nineinchnick - These are container ports and mapped to some random ports on host m/c, they wont't conflict. I have setup 2 ports, 8080 is without authentication and 8081 is with jwt authentication.

nineinchnick · 2024-04-22T08:06:13Z

trino/integration_test.go

@@ -106,6 +113,8 @@ func TestMain(m *testing.M) {
 			log.Fatalf("Timed out waiting for container to get ready: %s", err)
 		}
 		*integrationServerFlag = "http://test@localhost:" + resource.GetPort("8080/tcp")
+
+		http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}


Can we test without InsecureSkipVerify?

@nineinchnick - We can not easily test without InsecureSkipVerify as I have self signed certificate. The process of verifying certificate is more complicated, I think not worth for integration testing.

If you have self-signed certificates, you should have the CA too and set it here to be able to verify the server certificate.

@nineinchnick - Still working on this. I will have this by EOD.

nineinchnick · 2024-04-22T08:06:41Z

trino/integration_test.go

@@ -751,6 +760,28 @@ func TestIntegrationQueryContextCancellation(t *testing.T) {
 	}
 }

+func TestIntegrationBearerAuth(t *testing.T) {
+	bearerAuth := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0IiwiZXhwIjo0ODY3MjQ4MzY1fQ.a8O5YhYSn1WNedLqAYq8e5lXSwOkabZjhvKIAXPEGBc5juYBgnWcfad4kXn4PCoD6ykcmGACRuMiBNGbQMxPy6iX5vNie8tX-P-GuXhgHuRIcf6deVOibGb9RHaS0VwtwsgBZREhxF9-410db0k5qwipVJKu-t8mttvgIRhx2hyRaXigH2IT1W3Q06K3o81Olq-c_b4qF1oVpVEuQ7uzPUXb5LVK30YVBcUtFHtlYQX0ZJ_5hCTI37l5krBGIt--WOGs368tVrUPDLyhdEW2V7dN_NnPwfGuxzBVRTgC8oqGNlbOWSouUYrfW3gN6LYEckBfXGbk5daNQ5u0OmYkgg"


Is this token different from trino/etc/secrets/jwt_token? Do we need both? How long it's valid for?

Hi @nineinchnick - Thanks for your feedback.
The JWT token has a validity of 100 years and I can remove all the files in the directory that are not used (just added for completeness). Also, I will add steps in Readme file in case we need to generate the secrets again.

Yes, please remove unused files.

@nineinchnick - Removed unused files

nineinchnick · 2024-04-22T08:08:25Z

trino/trino.go

@@ -362,9 +366,14 @@ func newConn(dsn string) (*Conn, error) {
 		trinoSchemaHeader:          query.Get("schema"),
 		trinoSessionHeader:         query.Get("session_properties"),
 		trinoExtraCredentialHeader: query.Get("extra_credentials"),
+		authorization:              query.Get("bearer_auth"),


Add a method that would prefix the value of query.Get("bearer_auth") if it's not empty to avoid the condition in the loop below.

@nineinchnick - Fixed. Please check.

cla-bot · 2024-04-23T03:40:00Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2024-04-23T03:54:17Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

nineinchnick · 2024-04-23T08:01:00Z

BTW this will fix #59

nineinchnick

Almost there, you can resolve my comments that were already addressed (I can't).

nineinchnick · 2024-04-23T08:05:38Z

trino/integration_test.go

@@ -751,6 +760,28 @@ func TestIntegrationQueryContextCancellation(t *testing.T) {
 	}
 }

+func TestIntegrationAccessToken(t *testing.T) {
+	accessToken := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb3RyaW5vIiwic3ViIjoidGVzdCIsImV4cCI6NDg2NzQzMTgzMH0.qKwLIsAxg6O2RfonRcxMatXuQ8Prw_lLqnl7cCt1zRgL_zcZBAm4rdv8PFu2QpWshIG7675n0VE0y4c5q1-Q-ifuCbfAAExD8SXEi5_aa2299xiQH8ADmrycizzebGNIwwK1qzH6u3jNWwSkABbDaJ58Z7vnQDPE5yir_Fap4mE7-OXWjuKF5CNL9CbtfBMEsnMtSZ6kRTvlBQ84dNOaYwcHPhQQuwKaIFFzrvN_nathFc5r1qjLkSvxA6mPLGw-dqXt2k0QD0DEppyu80b0BL3pPLXXZ99VfGR2iW0j2n34D_3PF4gUOTSh8jpfzrDPC-qqxlfUb_5yTA-LBDImsw"


Since you ported the code that generates this to Go, you could move it into a method and generate a short-lived token every time in this test. It should be quick enough, right?

nineinchnick · 2024-04-23T08:07:06Z

trino/integration_test.go

+	if count < 1 {
+		t.Fatal("not enough rows returned:", count)
+	}


Instead of counting rows, I think we should use a more deterministic query, like SELECT 1 and test for the return value. This will help to avoid breaking this test if we add some more test catalogs.

nineinchnick · 2024-04-24T17:39:20Z

@kamalkang-hpe did you close this my mistake or intentionally? I can finish this in another PR, preserving your authorship of the commits.

kamalkang-hpe · 2024-04-24T18:21:37Z

Hi Jan, Sorry, I used wrong GitHub account. Please do what is appropriate, and no need to preserve authorship. Sorry about that. Kamal From: Jan Waś ***@***.***> Date: Wednesday, April 24, 2024 at 1:40 PM To: trinodb/trino-go-client ***@***.***> Cc: Kang, Kamal ***@***.***>, Mention ***@***.***> Subject: Re: [trinodb/trino-go-client] Support for JWT Authentication (PR #110) @kamalkang-hpe<https://github.com/kamalkang-hpe> did you close this my mistake or intentionally? I can finish this in another PR, preserving your authorship of the commits. — Reply to this email directly, view it on GitHub<#110 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AX7UBBCYM4VLLNJRLB5ZOGLY67U55AVCNFSM6AAAAABGRXD5ACVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANZVGQ4TCNJZGQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

kamalkang-hpe added 4 commits April 17, 2024 16:57

Added JWT configurations

e3f3d3c

Added JWT configurations

b3c3235

Added JWT configurations

bf36fc5

Added JWT configurations

64fe1ec

nineinchnick reviewed Apr 22, 2024

View reviewed changes

PR feedback changes

06433b1

PR Review changes

91cb6b1

nineinchnick reviewed Apr 23, 2024

View reviewed changes

kamalkang-hpe changed the title ~~Added JWT Authentication~~ Support for JWT Authentication Apr 23, 2024

kamalkang-hpe closed this by deleting the head repository Apr 24, 2024

nineinchnick mentioned this pull request Apr 29, 2024

Support JWT authentication #113

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for JWT Authentication #110

Support for JWT Authentication #110

kamalkang-hpe commented Apr 21, 2024 •

edited

Loading

cla-bot bot commented Apr 21, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 22, 2024

kamalkang-hpe Apr 23, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 22, 2024

kamalkang-hpe Apr 23, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 22, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 22, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 22, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 23, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 22, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 23, 2024

nineinchnick Apr 22, 2024

kamalkang-hpe Apr 23, 2024

cla-bot bot commented Apr 23, 2024

cla-bot bot commented Apr 23, 2024

nineinchnick commented Apr 23, 2024 •

edited

Loading

nineinchnick left a comment

nineinchnick Apr 23, 2024

nineinchnick Apr 23, 2024

nineinchnick commented Apr 24, 2024

kamalkang-hpe commented Apr 24, 2024 via email

		@@ -0,0 +1 @@
		eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0IiwiZXhwIjo0ODY3MjQ4MzY1fQ.a8O5YhYSn1WNedLqAYq8e5lXSwOkabZjhvKIAXPEGBc5juYBgnWcfad4kXn4PCoD6ykcmGACRuMiBNGbQMxPy6iX5vNie8tX-P-GuXhgHuRIcf6deVOibGb9RHaS0VwtwsgBZREhxF9-410db0k5qwipVJKu-t8mttvgIRhx2hyRaXigH2IT1W3Q06K3o81Olq-c_b4qF1oVpVEuQ7uzPUXb5LVK30YVBcUtFHtlYQX0ZJ_5hCTI37l5krBGIt--WOGs368tVrUPDLyhdEW2V7dN_NnPwfGuxzBVRTgC8oqGNlbOWSouUYrfW3gN6LYEckBfXGbk5daNQ5u0OmYkgg

Support for JWT Authentication #110

Support for JWT Authentication #110

Conversation

kamalkang-hpe commented Apr 21, 2024 • edited Loading

cla-bot bot commented Apr 21, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cla-bot bot commented Apr 23, 2024

cla-bot bot commented Apr 23, 2024

nineinchnick commented Apr 23, 2024 • edited Loading

nineinchnick left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nineinchnick commented Apr 24, 2024

kamalkang-hpe commented Apr 24, 2024 via email

kamalkang-hpe commented Apr 21, 2024 •

edited

Loading

nineinchnick commented Apr 23, 2024 •

edited

Loading