feat: Trino Authentications

[dungdm93]

SUMMARY

Currently, Trino database in SuperSet only support Basic Authen (username/password). This PR aim to support more authen methods like:

• Kerberos
• JWT
• Custom Authentication

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

Add more unit-tests

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

Merging #17593 (c4b2229) into master (3a58424) will increase coverage by 1.54%.
The diff coverage is 68.51%.

❗ Current head c4b2229 differs from pull request most recent head fa8ea84. Consider uploading reports for the commit fa8ea84 to get more accurate results

@@            Coverage Diff             @@
##           master   #17593      +/-   ##
==========================================
+ Coverage   67.10%   68.65%   +1.54%     
==========================================
  Files        1612     1596      -16     
  Lines       64988    65269     +281     
  Branches     6872     6949      +77     
==========================================
+ Hits        43611    44808    +1197     
+ Misses      19510    18578     -932     
- Partials     1867     1883      +16     

Flag	Coverage Δ
hive	?
mysql	81.77% <68.51%> (-0.44%)	⬇️
postgres	81.78% <68.51%> (-0.49%)	⬇️
presto	81.65% <68.51%> (+28.49%)	⬆️
python	82.04% <68.51%> (-0.67%)	⬇️
sqlite	81.47% <68.51%> (-0.48%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
superset/utils/core.py	88.60% <16.66%> (-1.17%)	⬇️
superset/db_engine_specs/base.py	88.32% <72.72%> (-0.42%)	⬇️
superset/db_engine_specs/trino.py	68.51% <84.00%> (+4.66%)	⬆️
superset/models/core.py	89.56% <100.00%> (+0.07%)	⬆️
superset/db_engines/hive.py	0.00% <0.00%> (-85.19%)	⬇️
...superset-ui-core/src/query/types/PostProcessing.ts	58.33% <0.00%> (-41.67%)	⬇️
superset/dashboards/filter_state/commands/get.py	50.00% <0.00%> (-41.67%)	⬇️
...chart-echarts/src/MixedTimeseries/controlPanel.tsx	38.70% <0.00%> (-41.30%)	⬇️
superset/key_value/api.py	41.46% <0.00%> (-38.06%)	⬇️
...uperset/dashboards/filter_state/commands/update.py	63.63% <0.00%> (-31.37%)	⬇️
... and 670 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3a58424...fa8ea84. Read the comment docs.

[dungdm93]

Hello @villebro
How to update testing.txt after modify requirements/testing.in. I wanna add -e file:.[trino] to testing.in but got this error:

[villebro]

First pass comments

[dungdm93]

@villebro changed as your comments

[geido]

Some typos to be fixed

[dungdm93]

@geido, @villebro all typos are fixed. Could you take a look.
And do you have any instruction/guide to re-generate requirements files?

[villebro]

Quick comment

[villebro]

@dungdm93 this is looking great, but we appear to be having some trouble with the documentation CI workflow. I restarted the job, let's see if it was just flaky

[villebro]

@dungdm93 I've fixed the build problems in the docs CI workflow in #17800 Can you rebase and see if that fixes the CI issues here?

[betodealmeida]

This looks great, and I particularly love the docs!

I left a suggestion on the schema of ALLOWED_EXTRA_AUTHENTICATIONS, I think we can improve it and make it more user-friendly.

[betodealmeida]

I'm not 100% sure, but I think the correct way of reading the config is:

from flask import current_app
if current_app.config["ALLOWED_EXTRA_AUTHENTICATIONS"]:
    ...

[betodealmeida]

We could make this a bit more user friendly and save some work:

from your.module import AuthClass
ALLOWED_EXTRA_AUTHENTICATIONS = {
    "trino": {
        "custom_auth": AuthClass,
        ...
    },
}

This way users can refer to the auth by a readable name like "custom_auth", and the module is already imported so you don't need to implement import_string.

[dungdm93]

That is a good idea. I implement it now.

[betodealmeida]

This looks great!

[eschutho]

@dungdm93 if people are currently passing username/password in their secure extra field, is this the same configuration, or will their existing configuration break?

[dungdm93]

Basically, before this PR, passing username/password in the secure extra won't work, because trino wrap username/password in the BasicAuthentication object

[dungdm93]

Basically, before this PR, passing username/password in the secure extra won't work, because trino wrap username/password in the BasicAuthentication object