Cannot connect to Trino via OAUTH2 with SSO credentials

[lejanco]

I am trying to connect to trino via oauth2 using the externalauthentication instructions in the README(e.g. keyring). I have tried (what seems like) everything. You can see the commented out efforts here as well. I have done the pip install 'trino[]'

trino_connection = trino.dbapi.connect(host=host, port=port, user=username, catalog=catalog, schema=schema, auth=trino.auth.OAuth2Authentication( # redirect_auth_url_handler=redirect_auth_url_handler ), http_scheme=http_scheme, # verify=False, # extra_credential=[('user', username), # ('password', password), # ("SSL", "true"), # ("SSLVerification", "NONE"), # ("externalAuthentication", "true") # ] )

The debug suggests the token is being retrieved but not being authenticated. Help is greatly appreciated, but please limit suggestions that require admin rights to trino as I do not have that authorization. Thanks:

DEBUG:

[lejanco]

I guess debug didn't paste. Here is a sample (redacted)
trino_df = pd.read_sql_query(sql=read_trino_sql, con=sql_alchemy_engine)
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1)::443
DEBUG:urllib3.connectionpool:https://host:port "POST /v1/statement HTTP/1.1" 401 12
DEBUG:urllib3.connectionpool:https://host:port "GET /oauth2/token/ HTTP/1.1" 200 127
DEBUG:urllib3.connectionpool:https://host:port "GET /oauth2/token/ HTTP/1.1" 200 127

[mosabua]

@lejanco can you please fix the code snippets in the descriptions so it is actually readable and we can compare it to the docs in the readme at https://github.com/trinodb/trino-python-client?tab=readme-ov-file#oauth2-authentication

[hashhar]

Also according to the DBeaver configs you mentioned you would need something like:

trino_connection = trino.dbapi.connect(
			 host=host,
			 port=port, 
			 user=username, 
			 catalog=catalog, 
			 schema=schema,
			 verify=False, # SSLVerification=NONE
			 http_scheme="https", # SSL=True
			 auth=trino.auth.OAuth2Authentication() # implies externalAuthentication=True
		)

[lejanco]

@hashhar
To Answer your questions
So are you running the Python script on a server or a local machine?

• Currently running of local

Does it open a browser window for you when you run the script to perform the OAuth login?

• Only if I specify it to open: webbrowser.open_new(r"https:///oauth2/callback/")

I did try the script above originally and the traceback is the same.

[hashhar]

Only if I specify it to open: webbrowser.open_new(r"https:///oauth2/callback/")

This is unexpected. By default if you use auth=trino.auth.OAuth2Authentication() it should open a web browser window to perform the OAuth login, if the browser cannot be opened then it prints a URL which you need to manually open. From the traceback you shared it doesn't seem like either of it happened.

Without the server logs it's almost impossible to tell what is going wrong since it's the server who receives the token and responds to the client.

[matialm]

@hashhar the redirect callback it's not working because when try to get x_redirect_server it's returning None because the parser return "Bearer x_redirect_server" instead "x_redirect_server". I trying change that to test it and it works.

The problem is in auht.py file _attempt_oauth method.

I will try to create a pr to fix it.

[matialm]

This should fix the problem
#445