Group mapping#

Group providers in Trino map usernames onto groups for easier access control and resource group management.

Configure a group provider by creating an etc/group-provider.properties file on the coordinator:

group-provider.name=file

The value for group-provider.name must be either file or ldap and the configuration of the chosen group provider must be included in the same file.

Group provider configuration#

Property name

Description

group-provider.name

Name of the group provider to use. Supported values are:

group-provider.group-case

Optional transformation of the case of the group name. Supported values are:

  • keep: default, no conversion

  • upper: convert group name to UPPERCASE

  • lower: converts the group name to lowercase

Defaults to keep.

Integration with access control#

Groups resolved by the group provider are passed to Trino’s system access control engine. Access control rules can reference these group names to grant or restrict permissions.

File group provider#

The file group provider resolves group memberships with the configuration in the group-provider.properties file on the coordinator.

Configuration#

Enable the file group provider by creating an etc/group-provider.properties file on the coordinator:

group-provider.name=file
file.group-file=/path/to/group.txt

The following configuration properties are available:

File group provider configuration#

Property name

Description

file.group-file

Path of the group file.

file.refresh-period

Duration between refreshing the group mapping configuration from the file. Defaults to 5s.

Group file format#

The group file contains a list of groups and members, one per line, separated by a colon. Users are separated by a comma.

group_name:user_1,user_2,user_3

LDAP group provider#

To configure the LDAP group provider, see LDAP group provider configuration.