-
Notifications
You must be signed in to change notification settings - Fork 24
Description
DETAILS:
- Plugin version: 1.0.7
- Trino version: Starburst Enterprise 462-e LTS
ISSUE:
When using Starburst Enterprise with Built-In Access Control as RBAC, we are unable to define the role the connecting user from Grafana should assume. The observation is that the connecting user always receives the default 'public' role which has insufficient privileges to query catalogs. There does not appear to be a way to assign a different role other than 'public' to the connecting user.
REPRODUCTION:
The grafana-trino plugin does not appear to support the following known methods to declare the RBAC role for the connecting user:
Pass X-Trino-Role Header
A common way to pass the role declaration is via the X-Trino-Role header. The grafana-trino plugin includes a 'Custom HTTP Headers' section, but it does not appear to support the use of X-Trino-Role header (it appears as if only certain headers are allowed?)
Pass Role in JDBC URL String
Another way to pass the role declaration is to append ?roles=system:{roleName} to the JDBC URL. Appending this content to the JDBC URL does not appear to be honored.