OAuth 2.0 authentication#

Trino can be configured to enable OAuth 2.0 authentication over HTTPS for the Web UI and the JDBC driver. Trino uses the Authorization Code flow which exchanges an Authorization Code for a token. At a high level, the flow includes the following steps:

  1. the Trino coordinator redirects a user’s browser to the Authorization Server

  2. the user authenticates with the Authorization Server, and it approves the Trino’s permissions request

  3. the user’s browser is redirected back to the Trino coordinator with an authorization code

  4. the Trino coordinator exchanges the authorization code for a token


OAuth 2.0 authentication currently supports JWT access tokens only, and therefore does not support opaque access tokens.

To enable OAuth 2.0 authentication for Trino, configuration changes are made on the Trino coordinator. No changes are required to the worker configuration; only the communication from the clients to the coordinator is authenticated.

Set the callback/redirect URL to https://<trino-coordinator-domain-name>/oauth2/callback, when configuring an OAuth 2.0 authorization server like an OpenID-connect provider.

Trino server configuration#

Using the OAuth2 authentication requires the Trino coordinator to be secured with TLS.

The following is an example of the required properties that need to be added to the coordinator’s config.properties file:




In order to enable OAuth 2.0 authentication for the Web UI, the following properties need to be added:


The following configuration properties are available:

OAuth2 configuration properties#




The type of authentication to use. Must be set to oauth2 to enable OAuth2 authentication for the Trino coordinator.


The authorization URL. The URL a user’s browser will be redirected to in order to begin the OAuth 2.0 authorization process.


The URL of the endpoint on the authorization server which Trino uses to obtain an access token.


The URL of the JSON Web Key Set (JWKS) endpoint on the authorization server. It provides Trino the set of keys containing the public key to verify any JSON Web Token (JWT) from the authorization server.


The public identifier of the Trino client.


The secret used to authorize Trino client with the authorization server.


The audience of a JSON Web Token is used as the target audience of an access token requested by the Trino coordinator as well as the required audience of an access token included in user requests to the coordinator.


Scopes requested by the server during the authorization challenge. See: https://tools.ietf.org/html/rfc6749#section-3.3


Maximum duration of the authorization challenge. Default is 15m.


A secret key used by the SHA-256 HMAC algorithm to sign the state parameter in order to ensure that the authorization request was not forged. Default is a random string generated during the coordinator start.


Regex to match against user. If matched, the user name is replaced with first regex group. If not matched, authentication is denied. Default is (.*) which allows any user name.


File containing rules for mapping user. See User mapping for more information.


The field of the access token used for the Trino user principal. Defaults to sub. Other commonly used fields include sAMAccountName, name, upn, and email.


If you need to debug issues with Trino OAuth 2.0 configuration you can change the log level for the OAuth 2.0 authenticator: