Skip to content

[OPA] - Enrich OPA Request with queryId #25904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
harshit2283 opened this issue Jun 2, 2025 · 0 comments
Open

[OPA] - Enrich OPA Request with queryId #25904

harshit2283 opened this issue Jun 2, 2025 · 0 comments

Comments

@harshit2283
Copy link

When Trino uses OPA for authorization, a single Trino query can generate multiple decision requests to OPA. This makes it difficult to trace which specific Trino query is responsible for a particular OPA decision log entry, hindering debugging and auditing efforts.

We propose enhancing the OPA integration to capture the Trino queryId from the security context, which is available during query lifecycle operations. This queryId should then be consistently included in the decision logs generated by OPA.

This change will significantly improve traceability by directly linking OPA decisions to their originating Trino queries. It will simplify the process of identifying queries that trigger specific authorisation outcomes, aiding in faster troubleshooting and providing a clearer audit trail for security analysis.

Here's a relevant PR - #25769

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant