Trino User Impersonation

Trino impersonation runs each query as the calling user rather than the service account. It uses Trino's X-Trino-User header. The trinoUserImpersonation helper builds an impersonation resolver that maps a JWT claim to that header.

Impersonation is Layer 2 of LakeQL's authorization model: it is what lets each data source enforce its own per-user access control. Without it, queries run with the source's service credentials.

Set it on the Trino data source in lakeql.config.ts:

1
2
3
4
5
6
7
8
9
10
import { trinoUserImpersonation } from "@lakeql/api/trino-user-impersonation"

dataSources: {
  warehouse: {
    adapter: "trino",
    connection: { /* ... */ },
    impersonationResolver: trinoUserImpersonation(),
  },
}

Choosing the Claim #

The resolver reads the userName claim by default. Set nameField to use a different claim:

1
2
trinoUserImpersonation({ nameField: "preferred_username" })

Transforming the Value #

Use transform when the IdP claim does not match the Trino username verbatim:

1
2
3
4
5
6
7
8
9
// Case normalization
trinoUserImpersonation({
  nameField: "onpremsamaccountname",
  transform: "lower",
})

// Custom mapping, e.g. strip a domain
trinoUserImpersonation({ transform: (v) => v.split("@")[0] })

transform accepts "lower", "upper", or a function. It is applied only to a present, non-empty string claim.

Fallback Behavior #

When the claim is missing, not a string, empty, or transforms to an empty string, the resolver returns null. The query then runs as the system user instead of failing. Resolution is two-level. A per-data-source resolver takes precedence over a global auth.impersonationResolver.