https://linen.dev logo
Join Slack
Powered by
Hi Permit team, We're integrating Trino with OPA f...
# general
b
Hi Permit team, We're integrating Trino with OPA for authorization. Currently, Trino's OPA plugin only supports connecting to a single OPA server. Our use case requires routing authorization requests to different OPA/PDP instances based on the catalog being accessed on microservice (SqlDB1 -> Opa1 , SqlDB2 -> Opa2). Does Permit support multiple PDP endpoints with intelligent routing based on resource attributes (catalog, schema, etc.)? Thank you
a
Hey @B22DCCN393 Nguyễn Việt Huy, Thanks for reaching out ! 🙂 Let me check with the team and will circle back to you soon. Meanwhile @Ask Inkeep please help here
a
Thanks for tagging me @Alon Boshi. I'll look through relevant sources and get back to you shortly.
* Hi there! 👋 Based on the available documentation, Permit's Trino integration configures a ​*single PDP endpoint*​ in Trino's 
access-control.properties
file (1) :
Copy code
access-control.name=opa
opa.policy.uri=http://<pdp-host>:7766/trino/allowed
opa.policy.row-filters-uri=http://<pdp-host>:7766/trino/row-filter
opa.policy.batch-column-masking-uri=http://<pdp-host>:7766/trino/batch-column-masking
The documentation doesn't describe built-in support for routing authorization requests to different PDP instances based on catalog or resource attributes. This is a limitation on Trino's side—Trino's OPA plugin currently only supports connecting to a single authorization endpoint . ​*Potential approaches to consider:*​ 1. ​*Single PDP with unified policy*​: Deploy one PDP that handles authorization for all catalogs, with policies configured per-catalog resource in Permit 2. ​*Dedicated Permit environment per cluster*​: Use a dedicated Permit project/environment for each Trino cluster if you need isolated authorization 3. ​*Load balancer with custom routing*​: Place a routing layer (reverse proxy) in front of multiple PDPs that routes based on request attributes—though this would require custom implementation outside of Permit For your specific use case (SqlDB1 → OPA1, SqlDB2 → OPA2) , you'd likely need to implement custom routing logic at the infrastructure level, as neither Permit nor Trino's OPA plugin natively supports this pattern. I'd recommend reaching out directly to discuss your architecture needs—email help@permit.io for further guidance on this advanced use case.
To learn more, see the sources I considered: [[1] Trino Integration](https://docs.permit.io/integrations/database-access-control/trino-integration)
d
Hey @B22DCCN393 Nguyễn Việt Huy, thank you for reaching out. With the PDP, you can scale out your PDP Cluster and have Trino access each PDP, evenly distributing the load between them. You can easily deploy it using our PDP Helm Chart. This could support any check load requested from your Trino cluster. Inside Permit, the entire policy is already fully independent for each catalog in your Trino, letting you fine-grained control of the permissions of each your to each catalog. Further more, you can even use Policy Guard to control what Permit members can modify permissions for each of your catalogs. You can also manage your Permit Policy via our Terraform Provider, so you could isolate it however you want. Trino does not support routing authorization checks for different catalogs to different OPA / PDP instances. It unifies all authorization checks against a single authorization server. If for some reason you want to re-route those checks, you can implement an OPA instance getting checks from Trino, then based on the input catalog, use 
http.send
to reverse-proxy the check to other OPA instances. That said, it may introduce performance issues and complications around top-level checks that are not associated with any specific catalog in Trino (e.g. 
execute_query
) Using Permit PDP, you are able to easily scale out your PDPs to support the high throughput needed for Trino authorization checks, and you can fully isolate permission policies for each of your catalogs. You can read about the Trino Integration more in this tutorial: https://docs.permit.io/integrations/database-access-control/trino-integration Feel free to reach out if you have further questions 🌟
Open in Slack
PreviousNext
Powered by