Added functionality to only allow one auth method simultaneously in the TrinoHook

providers/trino/docs/changelog.rst

@@ -23,10 +23,12 @@
 
 ``apache-airflow-providers-trino``
 
-
 Changelog
 ---------
 
+.. warning::
+    Make sure the connection you use to authenticate with Trino, has only one authentication method set (e.g password, jwt) otherwise the task will fail.
+
 6.3.2
 .....
 

providers/trino/src/airflow/providers/trino/hooks/trino.py

@@ -150,8 +150,19 @@ def get_conn(self) -> Connection:
         extra = db.extra_dejson
         auth = None
         user = db.login
-        if db.password and extra.get("auth") in ("kerberos", "certs"):
-            raise AirflowException(f"The {extra.get('auth')!r} authorization type doesn't support password.")
+        auth_methods = []
+        if db.password:
+            auth_methods.append("password")
+        if extra.get("auth") == "jwt":
+            auth_methods.append("jwt")
+        if extra.get("auth") == "certs":
+            auth_methods.append("certs")
+        if extra.get("auth") == "kerberos":
+            auth_methods.append("kerberos")
+        if len(auth_methods) > 1:
+            raise AirflowException(
+                f"Multiple authentication methods specified: {', '.join(auth_methods)}. Only one is allowed."
+            )
         if db.password:
             auth = trino.auth.BasicAuthentication(db.login, db.password)
         elif extra.get("auth") == "jwt":

providers/trino/tests/unit/trino/hooks/test_trino.py

@@ -109,7 +109,10 @@ def test_get_conn_invalid_auth(self, mock_get_connection):
             extra=json.dumps(extras),
         )
         with pytest.raises(
-            AirflowException, match=re.escape("The 'kerberos' authorization type doesn't support password.")
+            AirflowException,
+            match=re.escape(
+                "Multiple authentication methods specified: password, kerberos. Only one is allowed."
+            ),
         ):
             TrinoHook().get_conn()