Trino

Trino is a distributed SQL query engine over many data stores (Hive, Iceberg, Delta Lake, relational databases and more). Fresco BI connects to the Trino coordinator over HTTPS, lists catalogs, schemas, tables and views, and imports the tables you pick into a Data Table.

Feature	Supported
Import	Yes
DirectQuery	No
SSL/TLS	Always on (verified)
SSH tunnel	No
Cloud	Yes
On-premises (via Gateway)	No

Prerequisites

• A Trino coordinator with HTTPS enabled and a certificate issued for its host name. Fresco BI never sends credentials over plain HTTP.
• Password authentication (for example LDAP or a password file) or JWT authentication configured on the coordinator.
• Access to the coordinator’s access control configuration to grant read-only rights.

Step 1: Create a read-only user

Create the user fresco_reader in your authenticator (LDAP, password file) with a <strong-password>, or issue it a JWT signed by a key the coordinator trusts.

Fresco BI runs SHOW CATALOGS, reads information_schema (schemata, tables, columns) and runs SELECT. Give the user read-only rights and nothing else. With file-based access control, add rules like these to the rules file:

{
  "catalogs": [
    { "user": "fresco_reader", "catalog": "<catalog>", "allow": "read-only" }
  ],
  "tables": [
    { "user": "fresco_reader", "catalog": "<catalog>", "privileges": ["SELECT"] }
  ]
}

Rules are matched in order, so place them above broader rules. A rule on the catalog (not on one table) also covers tables created later.

If your catalogs use SQL-standard grants instead, grant SELECT on the tables Fresco BI should read:

GRANT SELECT ON <catalog>.<schema>.<table> TO USER fresco_reader;

Step 2: Allow network access

Fresco BI connects to the coordinator’s HTTPS port over the internet. Allow inbound connections from Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) on that port (443 by default) in your firewall or security group.

The coordinator must have a public address: private, loopback and metadata addresses are blocked, and Trino has no On-premises (via Gateway) or SSH tunnel option.

Step 3: Fill in the form

Field	What to enter
Host	Coordinator host name, for example trino.example.com
Port	HTTPS port of the coordinator (default 443)
Catalog	One catalog to list. Leave empty to list every catalog.
User	fresco_reader
Sign-in method	Password (default) or JWT
Password	The user’s password (password sign-in)
JWT	The token (JWT sign-in)
CA certificate (PEM)	Only for a private or self-signed CA. Empty uses the system trust store.
Maximum run time	Minutes a query may run, 1–240 (default 60)

Use the same host name that the coordinator puts in its own answers. Fresco BI follows the next pages of a query only on the host you entered and refuses redirects to any other host, so a proxy that rewrites the address breaks the connection.

Click Test connection: it signs in and runs SELECT 1. Then click Save.

SSL modes

Trino connections are always encrypted and verified: the certificate must be signed by a trusted CA (or the CA you paste) and issued for the host name you entered.

Troubleshooting

• The server rejected the user name or password. Wrong password, an expired or untrusted JWT, or the user does not exist in the authenticator.
• The database user cannot read this object. Access control denies fresco_reader. Add the read-only rules from Step 1.
• The database or object was not found on the server. The catalog, schema or table does not exist or was renamed. Check the Catalog field.
• The SSL connection could not be set up with the chosen mode. Check the SSL mode and the CA certificate. The certificate is not trusted or not issued for this host. Paste the right CA into CA certificate (PEM), or use the host name in the certificate.
• The host name could not be resolved (DNS). Check the Host field. Check the host spelling and public DNS.
• The host is in a blocked range (private, loopback or metadata). A database inside a private network needs an On-premises connection through a Gateway. The host resolves to a private address. Trino must be reachable on a public address.
• No connection could be opened to this host and port. Check the host, the port, and that the firewall allows Fresco BI’s IP. The port is closed, the firewall blocks Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them), or the coordinator answered with an HTTP 502, 503 or 504 error.
• The server did not answer in time. Usually a firewall that drops packets, or a wrong host or port. A firewall drops packets, or a query passed the Maximum run time.
• A size or concurrent-connection limit was exceeded. Trino rejected the query (queue full, memory or scan limit). Try again later or ask the Trino admin to raise the limit.
• The source returned a data type this connector does not support. varbinary, array, map, row and interval columns cannot be imported; leave them out of the Data Table.