Receiving an Unfamiliar ID Instead of Username with OAuth2 Azure EntraID Authentication

[AlakmarShafin]

I'm working on configuring Azure Entra ID with Trino for authentication. Although the setup appears to be successful, I'm encountering an issue where a strange ID is being displayed in the Trino UI instead of my Azure ID.

I'm unsure where this ID originates from. I've verified that it isn't the object ID of the AAD user. Since I'm using Azure ID in file-based access control, I need to identify this ID to map it with the corresponding Azure ID.

Below is my config.properties

coordinator=true
node-scheduler.include-coordinator=false
http-server.http.port=80
discovery.uri=http://localhost:80
http-server.https.enabled=true
http-server.https.port=443
http-server.https.keystore.path=/etc/trino/healthrxcert.pem
http-server.authentication.type=oauth2,PASSWORD
password-authenticator.config-files=/etc/trino/password-authenticator.properties
http-server.authentication.oauth2.issuer=https://login.microsoftonline.com/<tenent ID>/v2.0
http-server.authentication.oauth2.client-id=<ID>
http-server.authentication.oauth2.client-secret=<SECRET>
http-server.authentication.oauth2.auth-url=https://login.microsoftonline.com/<tenent ID>/oauth2/v2.0/authorize
http-server.authentication.oauth2.token-url=https://login.microsoftonline.com/<tenent ID>/oauth2/v2.0/token
http-server.authentication.oauth2.jwks-url=https://login.microsoftonline.com/<tenent ID>/discovery/v2.0/keys
http-server.authentication.oauth2.userinfo-url=https://graph.microsoft.com/oidc/userinfo
http-server.authentication.oauth2.scopes=openid
web-ui.authentication.type=oauth2

[hashhar]

Try inspecting the JWT token returned by Azure Entra. This is probably the sub value in the token. You can use a different field for the principal by setting http-server.authentication.oauth2.principal-field. See docs for more - https://trino.io/docs/current/security/oauth2.html#trino-server-configuration

[AlakmarShafin]

Hi @hashhar, thanks for replying.

I have already tried this, when I configure this property other than "sub" (I have tried "email" and "upn" ) it gives me an error: "unauthorized" on UI after login using the same azure id which was previously working with "sub".

[hashhar]

Try with http-server.authentication.oauth2.scopes=openid,offline or http-server.authentication.oauth2.scopes=openid,offline_access.