diff --git a/docs/src/main/sphinx/security/built-in-system-access-control.md b/docs/src/main/sphinx/security/built-in-system-access-control.md index 04cfa1c57339..2ef2547b2f8f 100644 --- a/docs/src/main/sphinx/security/built-in-system-access-control.md +++ b/docs/src/main/sphinx/security/built-in-system-access-control.md @@ -13,10 +13,29 @@ cluster nodes: access-control.name=allow-all ``` -Multiple system access control implementations may be configured at once -using the `access-control.config-files` configuration property. It should -contain a comma separated list of the access control property files to use -(rather than the default `etc/access-control.properties`). +(multiple-access-control)= +## Multiple access control systems + +Multiple system access control implementations may be configured at once using +the `access-control.config-files` configuration property. It must contain a +comma-separated list of the access control property files to use, rather than +the default `etc/access-control.properties`. Relative paths from the Trino +`INSTALL_PATH` or absolute paths are supported. + +The configured access control systems are used in order until access rights are +either granted or denied, and must use different types. Each system is +configured in a separate configuration file. + +For example, you can combine `file` access control and `ranger` +access control with the two separate configuration files `file-based.properties` +and `ranger.properties`, but you can not use two separate file-based access +control configurations. + +```properties +access-control.config-files=etc/file-based.properties,etc/ranger.properties +``` + +## Available access control systems Trino offers the following built-in system access control implementations: diff --git a/docs/src/main/sphinx/security/opa-access-control.md b/docs/src/main/sphinx/security/opa-access-control.md index 3c247d84330f..45758d787370 100644 --- a/docs/src/main/sphinx/security/opa-access-control.md +++ b/docs/src/main/sphinx/security/opa-access-control.md @@ -23,17 +23,8 @@ access-control.name=opa opa.policy.uri=https://opa.example.com/v1/data/trino/allow ``` -To combine OPA access control with file-based or other access control systems, -configure multiple access control configuration file paths in -`etc/config.properties`: - -```properties -access-control.config-files=etc/trino/file-based.properties,etc/trino/opa.properties -``` - -Order the configuration files list in the desired order of the different systems -for overall access control. Configure each access-control system in the -specified files. +To combine OPA access control with file-based or other access control +systems, follow the instructions about [](multiple-access-control). The following table lists the configuration properties for the OPA access control: diff --git a/docs/src/main/sphinx/security/ranger-access-control.md b/docs/src/main/sphinx/security/ranger-access-control.md index 6b1bd8288871..8ae7a50be55c 100644 --- a/docs/src/main/sphinx/security/ranger-access-control.md +++ b/docs/src/main/sphinx/security/ranger-access-control.md @@ -25,17 +25,7 @@ access-control.name=ranger ``` To combine Ranger access control with file-based or other access control -systems, create the file `etc/access-control.properties` on the coordinator, -with the following configuration that lists multiple access control -configuration file paths: - -```properties -access-control.config-files=etc/trino/file-based.properties,etc/trino/ranger.properties -``` - -Order the configuration files list in the desired order of the different systems -for overall access control. Configure each access-control system in the -specified files. +systems, follow the instructions about [](multiple-access-control). The following table lists the configuration properties for the Ranger access control: