Plugin + ldap

[naude-r]

hi,

have started making use if your published plugin + ranger build.

have you tested this using ldap auth in trino? anything specific we should lookout for?

currently from ranger we have the trino service up and running. policy creation also works, with auto complete of catalogs etc.

from trino, however, no policies are in the cache directory. looks like something is failing. logs do not contain any errors / exceptions.

any idea?

[aakashnand]

@naude-r I used this plugin with LDAP authentication and it worked fine.

If policies are not downloaded on the trino server, something is wrong between the Ranger admin and the trino server.

Here are a few steps you can try

1. Check network connectivity between the trino server and Ranger admin (ping, telnet, etc)
2. Check if there are SSL certificate issues.
3. Use Trino Slack search to find relevant threads and messages related to LDAP and Trino, you might find some useful resources.
4. Enable the DEBUG flag on the trino server and Ranger admin and see if you can find something.

[naude-r]

thank you.

a bit of a noob when it comes to ranger and trino.

ranger to trino works fine. when adding a policy the field autocomplete works, which would indicate that ranger to trino integration is up and running.

when you say "DEBUG" flag, do you mean the log level? this is currently set to TRACE for both the coordinator / worker nodes of trino.

where/how fits trino-ranger-plugin-logback.xml into the picture? after trino start/run it is still in the install directory, ie where the plugin was extracted. not sure if this is correct?

[naude-r]

found the issue.

using the helm chart to deploy trino. the plugin is enabled during container build. the updated and configured config got overridden with the config maps.

will need to think of a different way of doing this.

[naude-r]

now that the plugin is active, the ranger -> trino comms is broken, ie the trino service "Test Connection" fails.

not sure how ranger-admin is granted access? should this not be a valid ldap user?

[JavadHosseini]

Hi @naude-r , I have the same setup and also the same issue. I can define policy in Ranger for trino catalogs and other resources, but there is no policy cache in Trino. I used helm chart to deploy trino. I also checked trino config maps and didn't find anything suspicious. Have you resolved your issue?

[naude-r]

@JavadHosseini yes and no. the problem is that the chart overwrites the config files generated during container creation. at runtime /etc/trino is also mounted read-only. modified the chart to not replace the whole of /etc/trino, but rather only specific files. this worked better....not perfect. since then we've moved to a managed instance of trino.

[JavadHosseini]

Oh I see, but in my case the policy cache is in /etc/ranger/trino dir. Also all the config files related to ranger trino plugin is on the container. I build the trino image with the ranger plugin enabled in it.