Helm Chart - how to add ldap to Password authenticator

[preetsindhal]

Password authenticator name is set to file if authenticationType is PASSWORD
https://github.com/trinodb/charts/blob/main/charts/trino/templates/configmap-coordinator.yaml#L95

How to change this from file to ldap

Thanks.

[zeddit]

@preetsindhal I am facing the same requirements, If you come up with any solution, could you please share it with me. great thanks.

[luhea]

I am facing the same requirements, If you come up with any solution, could you please share it with me. great thanks.

[luhea]

Hello,zeddit.I solve it and did not need to modify the helm chart。my solution is config multiple auth in Helm's coordinatorExtraConfig. for example: http-server.authentication.type=PASSWORD,password-authenticator.config-files=/opt/trino-auth/ldap.properties,/opt/trino-auth/password.properties. this way defect is you should config local passworld auth .

[suisenkotoba]

hi @luhea were you able to to configure the TLS as well? I use helm chart and try to add file based authentication, but my coordinator keeps getting error. but when I use TLS load balancer by setting http-server.process-forwarded=true the client will get error Error running command: javax.net.ssl.SSLException: Unsupported or unrecognized SSL message. It'd be great help if you can show me how to configure the TLS with helm chart, I've been stuck with this problem for days. thanks in advance

[zeddit]

@suisenkotoba http-server.process-forwarded=true make trino work in non-tls mode, so ldap-auth cannot be enabled.

[pilipyukaaa]

i have same issure, when i try to discover coordinator in k8s i need jks store wich need do have CN, but i cant issure certificate for service into k8s
problem for file i fixed by hardcode configs
{{- if eq .Values.server.config.authenticationType "PASSWORD" }}
password-authenticator.properties: |
password-authenticator.name=ldap
ldap.url=ldaps://your ldap:636
ldap.allow-insecure=true
ldap.user-bind-pattern=uid=${USER},cn=users
{{- if .Values.auth.groups }}
but you need to broke others templates
{{- if eq .Values.server.config.authenticationType "sPASSWORD" }} in secret.yml
{{- if eq .Values.server.config.authenticationType "ssPASSWORD" }} in deployment-coordinator.yml

[luhea]

you should configure it in coordinater and worker: http-server.process-forwarded=true and internal-communication.shared-secret=xxxxx