add http-server.authentication.type=PASSWORD cause error

[s-amir]

I try to connect trino to LDAP , so in config.properties i add "http-server.authentication.type=PASSWORD" to authenticate users with LDAP
i also create password-authenticator.properties in /etc/password-authenticator.properties
but as I append "http-server.authentication.type=PASSWORD" in config.properties i get error :
Invalid configuration property with prefix '': file does not exist: etc/password-authenticator.properties (for class io.trino.server.security.PasswordAuthenticatorConfig.passwordAuthenticatorFiles[0].<list element>)

can anyone help

[hashhar]

What did you use to deploy? Docker image or tarball?

It seems you have placed the config file at /etc/password-authenticator.properties. If you re-read the docs you'll notice it says etc/password-authenticator.properties (note the lack of leading /) which means the path is relative to the Trino data directory. For the Docker image this means /etc/trino while in the tarball this means the same directory where you extracted Trino itself.

[s-amir]

thanks, i changed the path to what you said and i get different error
IllegalArgumentException: Shared secret (internal-communication.shared-secret) is required when authentication is enabled
can you help me how to solve it ?

password-authenticator.properties:

password-authenticator.name=ldap
ldap.url=ldaps://*******:636
ldap.ssl.truststore.path=/etc/trino/certs/trino-server.jks
ldap.ssl.truststore.password=changeit
ldap.user-bind-pattern=CN=%s,OU=data,DC=blu,DC=ir

I don't no what is shared-key!

[hashhar]

Add internal-communication.shared-secret=<some-random-but-unguessable-value> to config.properties on all nodes.
See https://trino.io/docs/current/security/overview.html#:~:text=Configure%20a%20a%20shared%20secret for the details.

See https://trino.io/docs/current/security/overview.html#suggested-configuration-workflow for the overall steps which I think you haven't seen yet.

[s-amir]

Thank you very much , I have another qustion , I want to use self-signed key , in this approach should I my self generate keys and certificate ?
finally I want to enable TLS in trino to connect to LDAP , and should I copy any certificate from ldap to trino ?
I read the documentation but i don't find any document to generate self-signed key!
I really appreciate your answers

[hashhar]

See https://trino.io/docs/current/security/tls.html#secure-trino-directly for TLS in general. Self-signed certs are no different. You import then into a trust/keystore and follow the same steps.

However using self-signed instead of public certs or at-least using an internal CA is asking for a lot of pain.