Support JWT authentication

README.md

@@ -11,7 +11,7 @@ Trino, and receive the resulting data.
 
 * Native Go implementation
 * Connections over HTTP or HTTPS
-* HTTP Basic and Kerberos authentication
+* HTTP Basic, Kerberos, and JSON web token (JWT) authentication
 * Per-query user information for access control
 * Support custom HTTP client (tunable conn pools, timeouts, TLS)
 * Supports conversion from Trino to native Go data types
@@ -60,7 +60,7 @@ db, err := sql.Open("trino", dsn)
 
 ### Authentication
 
-Both HTTP Basic and Kerberos authentication are supported.
+Both HTTP Basic, Kerberos, and JWT authentication are supported.
 
 #### HTTP Basic authentication
 
@@ -81,6 +81,17 @@ Please refer to the [Coordinator Kerberos
 Authentication](https://trino.io/docs/current/security/server.html) for
 server-side configuration.
 
+#### JSON web token authentication
+
+This driver supports JWT authentication by setting up the `AccessToken` field
+in the
+[Config](https://godoc.org/github.com/trinodb/trino-go-client/trino#Config)
+struct.
+
+Please refer to the [Coordinator JWT
+Authentication](https://trino.io/docs/current/security/jwt.html) for
+server-side configuration.
+
 #### System access control and per-query user information
 
 It's possible to pass user information to Trino, different from the principal
@@ -272,7 +283,7 @@ When reading response rows, the driver supports most Trino data types, except:
   `time.Time`. All precisions up to nanoseconds (`TIMESTAMP(9)` or `TIME(9)`)
   are supported (since this is the maximum precision Golang's `time.Time`
   supports). If a query returns columns defined with a greater precision,
-  values will be trimmed to 9 decimal digits. Use `CAST` to reduce the returned
+  values are trimmed to 9 decimal digits. Use `CAST` to reduce the returned
   precision, or convert the value to a string that then can be parsed manually.
 * `DECIMAL` - returned as string
 * `IPADDRESS` - returned as string
@@ -301,7 +312,7 @@ For two or three dimensional arrays, use `trino.NullSlice2Bool` and
 `trino.NullSlice3Bool` or equivalents for other data types.
 
 To read `ROW` values, implement the `sql.Scanner` interface in a struct. Its
-`Scan()` function will receive a `[]interface{}` slice, with values of the
+`Scan()` function receives a `[]interface{}` slice, with values of the
 following types:
 * `bool`
 * `json.Number` for any numeric Trino types

go.mod

@@ -3,6 +3,8 @@ module github.com/trinodb/trino-go-client
 go 1.21
 
 require (
+	github.com/ahmetb/dlog v0.0.0-20170105205344-4fb5f8204f26
+	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/ory/dockertest/v3 v3.10.0
 	github.com/stretchr/testify v1.9.0
 	gopkg.in/jcmturner/gokrb5.v6 v6.1.1
@@ -13,6 +15,7 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
+	github.com/ahmetalpbalkan/dlog v0.0.0-20170105205344-4fb5f8204f26 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/containerd/continuity v0.4.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect

go.sum

@@ -6,6 +6,10 @@ github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migc
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
+github.com/ahmetalpbalkan/dlog v0.0.0-20170105205344-4fb5f8204f26 h1:pzStYMLAXM7CNQjS/Wn+zK9MUxDhSUNfVvnHsyQyjs0=
+github.com/ahmetalpbalkan/dlog v0.0.0-20170105205344-4fb5f8204f26/go.mod h1:ilK+u7u1HoqaDk0mjhh27QJB7PyWMreGffEvOCoEKiY=
+github.com/ahmetb/dlog v0.0.0-20170105205344-4fb5f8204f26 h1:3YVZUqkoev4mL+aCwVOSWV4M7pN+NURHL38Z2zq5JKA=
+github.com/ahmetb/dlog v0.0.0-20170105205344-4fb5f8204f26/go.mod h1:ymXt5bw5uSNu4jveerFxE0vNYxF8ncqbptntMaFMg3k=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
@@ -27,6 +31,8 @@ github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfC
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=

trino/etc/config.properties

@@ -4,3 +4,11 @@ node-scheduler.include-coordinator=true
 http-server.http.port=8080
 discovery-server.enabled=true
 discovery.uri=http://localhost:8080
+
+http-server.authentication.type=PASSWORD,JWT
+http-server.authentication.jwt.key-file=/etc/trino/secrets/public_key.pem
+http-server.https.enabled=true
+http-server.https.port=8443
+http-server.authentication.allow-insecure-over-http=true
+http-server.https.keystore.path=/etc/trino/secrets/certificate_with_key.pem
+internal-communication.shared-secret=gotrino

trino/etc/password-authenticator.properties

@@ -0,0 +1,2 @@
+password-authenticator.name=file
+file.password-file=/etc/trino/secrets/password.db

trino/etc/secrets/.gitignore

@@ -0,0 +1 @@
+*.pem

trino/etc/secrets/password.db

@@ -0,0 +1 @@
+admin:$2y$10$xLVM/FUuZaNEmGOU3y7fjOLzRJOGItnTWTiFVKwIFX.ZMBctxl8gq