Password File Authentication#

Presto can be configured to enable frontend password authentication over HTTPS for clients, such as the CLI, or the JDBC and ODBC drivers. The username and password are validated against usernames and passwords stored in a file.

Password file authentication is very similar to LDAP Authentication. Please see the LDAP documentation for generic instructions on configuring the server and clients to use TLS and authenticate with a username and password.

Password Authenticator Configuration#

Enable password file authentication by creating an etc/ file on the coordinator:

The following configuration properties are available:




Path of the password file.


How often to reload the password file. Defaults to 5s.


Max number of cached authenticated passwords. Defaults to 1000.

Password Files#

File Format#

The password file contains a list of usernames and passwords, one per line, separated by a colon. Passwords must be securely hashed using bcrypt or PBKDF2.

bcrypt passwords start with $2y$ and must use a minimum cost of 8:


PBKDF2 passwords are composed of the iteration count, followed by the hex encoded salt and hash:


Creating a Password File#

Password files utilizing the bcrypt format can be created using the htpasswd utility from the Apache HTTP Server. The cost must be specified, as Presto enforces a higher minimum cost than the default.

Create an empty password file to get started:

touch password.db

Add or update the password for the user test:

htpasswd -B -C 10 password.db test