Rediger

Del via

Authentication mechanism

  • Artikel

Note

We will retire Azure HDInsight on AKS on January 31, 2025. Before January 31, 2025, you will need to migrate your workloads to Microsoft Fabric or an equivalent Azure product to avoid abrupt termination of your workloads. The remaining clusters on your subscription will be stopped and removed from the host.

Only basic support will be available until the retirement date.

Important

This feature is currently in preview. The Supplemental Terms of Use for Microsoft Azure Previews include more legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability. For information about this specific preview, see Azure HDInsight on AKS preview information. For questions or feature suggestions, please submit a request on AskHDInsight with the details and follow us for more updates on Azure HDInsight Community.

Trino with HDInsight on AKS provides tools such as CLI client, JDBC driver etc., to access the cluster, which is integrated with Microsoft Entra ID to simplify the authentication for users. Supported tools or clients need to authenticate using Microsoft Entra ID OAuth2 standards that are, a JWT access token issued by Microsoft Entra ID must be provided to the cluster endpoint.

This section describes common authentication flows supported by the tools.

Authentication flows overview

The following authentication flows are supported.

Note

Name is reserved and should be used to specify certain flow.

Name Required parameters Optional parameters Description
AzureDefault None Tenant ID, client ID Meant to be used during development in interactive environment. In most cases, user sign-in using browser. See details.
AzureInteractive None Tenant ID, client ID User authenticates using browser. See details.
AzureDeviceCode None Tenant ID, client ID Meant for environments where browser isn't available. Device code provided to the user requires an action to sign-in on another device using the code and browser.
AzureClientSecret Tenant ID, client ID, client secret None Service principal identity is used, credentials required, non-interactive.
AzureClientCertificate Tenant ID, client ID, certificate file path Secret/password. If provided, used to decrypt PFX certificate. Otherwise expects PEM format. Service principal identity is used, certificate required, non-interactive. See details.
AzureManagedIdentity Tenant ID, client ID None Uses managed identity of the environment, for example, on Azure VMs or AKS pods.

AzureDefault flow

This flow is default mode for the Trino CLI and JDBC if auth parameter isn't specified. In this mode, client tool attempts to obtain the token using several methods until token is acquired. In the following chained execution, if token isn't found or authentication fails, process will continue with next method:

DefaultAzureCredential -> AzureInteractive -> AzureDeviceCode (if no browser)

AzureInteractive flow

This mode is used when auth=AzureInteractive is provided or as part of AzureDefault chained execution.

Note

If browser is available, it will show authentication prompt and awaits user action. If browser isn't available, it will fallback to AzureDeviceCode flow.

AzureClientCertificate flow

Allows using PEM/PFX(PKCS #12) files for service principal authentication. If secret/password is provided, expects file in PFX(PKCS #12) format and uses the secret to decrypt the file. If secret isn't provided, expects PEM formatted file to include private and public keys.

Environment variables

All the required parameters could be provided to CLI/JDBC directly in arguments or connection string. Some of the optional parameters, if not provided, is looked up in environment variables.

Note

Make sure to check environment variables if you face authentication issues. They may affect the flow.

The following table describes the parameters that can be configured in environment variables for the different authentication flows.
They will only be used if corresponding parameter isn't provided in the command line or connection string.

Variable name Applicable authentication flows Description
AZURE_TENANT_ID All Microsoft Entra tenant ID.
AZURE_CLIENT_ID AzureClientSecret, AzureClientCertificate, AzureManagedIdentity Application/principal client ID.
AZURE_CLIENT_SECRET AzureClientSecret, AzureClientCertificate Secret or password for service principal or certificate file.
AZURE_CLIENT_CERTIFICATE_PATH AzureClientCertificate Path to certificate file.