Skip to content

Add Kerberos authentication support for Trino connections #282

Description

@humbledude

Summary

Please add Kerberos authentication support for Trino connections.

The underlying trino-python-client supports KerberosAuthentication, but sqlit's Trino connection form currently only exposes username, password, catalog, schema, and HTTP scheme. When a password is provided, sqlit creates BasicAuthentication; there is no way to select or configure Kerberos authentication.

Use case

Many enterprise Trino deployments use Kerberos/SPNEGO authentication. Users may already have a valid Kerberos ticket (for example, from kinit) and expect a terminal database client to use that ticket when connecting.

Suggested implementation

  • Add an authentication method selector to the Trino connection form:
    • None
    • Basic
    • Kerberos
    • Optionally GSSAPI
  • For Kerberos, install/use the Python client's Kerberos extra (trino[kerberos]) and pass KerberosAuthentication(...) to trino.dbapi.connect().
  • Expose relevant optional settings where possible, such as service name, hostname override, mutual authentication, and delegation.
  • Document any system prerequisites, such as having a valid Kerberos ticket before launching sqlit.

Expected behavior

A user who has already obtained a Kerberos ticket should be able to configure a Trino connection in sqlit, choose Kerberos authentication, and browse/query Trino catalogs without entering a password.

References

The Trino Python client documents Kerberos support here:

https://github.com/trinodb/trino-python-client#kerberos-authentication

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions