oidc support for dbt-trino about dbt-trino HOT 1 CLOSED

See following thread on dbt slack channel for more info.

1. When changing the authentication method to oauth as in the PR, the url is printed in the console.

If you follow each url, the driver will execute the openid connect flow, of course you need to follow this url's in the order specified in the console. of course his is not a great user experience.

2. Modified trino-python-client to launch a webbrowser instead of printing the link

def handle_redirect_auth_url(auth_url):
    print("Opening your browser for the external authentication:")
    webbrowser.open_new(auth_url)

This approach has two issues:

• it will launch a new browser window for each executed query.
• It seems to not work when multiple queries are launched simultaneously (not investigated in detail)

Some initial conclusions:

Comparing with how this is done in the snowflake pyhon connector, they actually provide a localhost callback url for the authentication flow, so they can capture the access token on the clientside, while in Trino's case the access token is retrieved on the server side and not exposed to the client (implicit flow vs authorization code.

A workaround could call the OIDC endpoint and retrieve a token and use that token (jwt authentication method in dbt-trino), in our case we would have to enable the implicit flow as our custom OIDC provider doesn't provide any means to request a token outside of the standard flows. Also this has to take into account token expiration. Most important i think this pushes complexity down upon the dbt user instead of providing a plug & play experience (which is really what dbt is about).

from dbt-trino.