Querying Trino Through Trino Gateway

Instead of connecting clients directly to the Trino coordinator, configure them to connect to Trino Gateway.

Example CLI Usage

Here is an example of accessing the same Trino cluster, either directly through the Coordinator or through Trino Gateway:

#!/usr/bin/env bash ORIG="$PATH" export PATH="/opt/jdk-23/bin:$PATH" # This assumes that trino-cli has been downloaded into this directory # and been renamed "trino". chmod +x ./trino if [ "$1" = "gateway" ]; then ./trino \ --server 'https://<TRINO_GATEWAY_HOST>:9104' \ --krb5-remote-service-name "HTTP" \ --krb5-principal "your_principal" \ --krb5-config-path /etc/krb5.conf \ --krb5-keytab-path /your/keytab/goes/here.keytab \ --krb5-service-principal-pattern '${SERVICE}@<COORDINATOR_HOST>' \ --catalog <catalog_name> \ --schema <schema_name> else ./trino \ --server 'https://<TRINO_COORDINATOR_HOST>:9098' \ --krb5-remote-service-name "HTTP" \ --krb5-principal "your_principal" \ --krb5-config-path /etc/krb5.conf \ --krb5-keytab-path /your/keytab/goes/here.keytab \ --catalog <catalog_name> \ --schema <schema_name> fi export PATH="$ORIG"

Kerberos Configuration Requirement

When connecting through Trino Gateway using Kerberos, add the following parameter:

--krb5-service-principal-pattern '${SERVICE}@<COORDINATOR_HOST>'

The ${SERVICE} token is automatically resolved by the Trino CLI and must not be modified.

By default, krb5-service-principal-pattern uses:

${SERVICE}@${HOST}

When connecting through Trino Gateway, replace ${HOST} with the Trino coordinator host instead of the Trino Gateway host. This ensures that Kerberos authentication is performed against the Trino coordinator service principal.

Query History

After queries are executed through Trino Gateway, the query history becomes visible in the UI.

The UI displays:

Query source
Routed Trino cluster
Query ID

The Query ID links to detailed query information on the destination Trino coordinator.

Last updated on May 27, 2026

Was this page helpful?