How to configure multiple rule.json in access-control.properties

[A-little-bit-of-data]

I read on the official website that there is this item in the access-control.properties configuration, security.config-file=etc/rules.json. Does anyone have such a need? There are many users. If it is written in a json file, the file will It is getting bigger and bigger and more and more difficult to control. I would like to ask everyone, can this rules.json be split into multiple parts? If so, how to configure it?

[gitvibav-abluva]

Hi @A-little-bit-of-data, I too have a need for this, but seems like this feature is not supported now. I tried contacting the community members in Slack and they told me about this. I think they should add these feature pretty soon, because it is much needed for users with thousands of policies. Therefore I am tagging @ebyhr and @mosabua.

[mosabua]

From what I know, nobody is working on that. In the end all the policies would still have to be collapsed into one set and then validated and such. As I mentioned on slack you can already do that now .. just have multiple files that you maintain in git or whereever and then have your deployment pipeline assembled on file from multiple input files..

If you want this actually as a feature in trino itself you will probably take up the work and send a pull request that implements that feature with tests and such.

[gitvibav-abluva]

With pleasure, I can implement this feature myself. But before that, if this feature is present, I am planning to implement that for my project.

[mosabua]

It should work .. as a result we updated the docs .. but you probably need to test it yourself.

See https://trino.io/docs/current/security/built-in-system-access-control.html#multiple-access-control-systems and keep in mind that each access control is separate

[gitvibav-abluva]

I tried implementing it locally but it wasn't working for me.

I have access-control.config-files=/etc/trino/file.properties,/etc/trino/file2.properties in my config.properties.

Then file.properties and file2.properties with

access-control.name=file
security.config-file=/etc/trino/rules.json
security.refresh-period=1s

access-control.name=file
security.config-file=/etc/trino/rules2.json
security.refresh-period=1s

Then separate json file with policies. It wasn't showing any error though, the server got started but the policies weren't applied. Can you please elaborate on keep in mind that each access control is separate

[mosabua]

Please read https://trino.io/docs/current/security/built-in-system-access-control.html#multiple-access-control-systems

You might expect a different behavior than how it works..

[gitvibav-abluva]

Sure will do that