Original-user vs principal?

[StephenOTT]

In the Trino http client, there is the original-user header, and there is the notion of principal in the api.

When you inspect the details of a query in the UI, you see the principal and the property for original-user.

What is the difference between the two?

Thanks

[hashhar]

There are things like user-mapping (https://trino.io/docs/current/security/user-mapping.html) where the username in authentication source is used to derive a user for use within Trino. e.g. from an LDAP DN to a simpler username.

The former is original_user and principal is what gets mapped in Trino (or the other way around, I don't remember).

[StephenOTT]

@hashhar thanks. So:

1. original user = user prior to user mapping
2. Principal= user post-user mapping (authenticated user)
3. User = current trino username? (Could be different than principal due to impersonation)

[hashhar]

Correct.

[StephenOTT]

Thank you