Integrated Data Security
Integrated Data Security
End-to-end security across the platform: single sign-on, user impersonation, fine-grained authorization, row-level filtering and column masking, enforced consistently by Open Policy Agent.
HOW TO START
With a Kubernetes cluster, run a single command:
Key Features
What this demo shows
Central authentication
Keycloak SSO for every component on the platform.
Row-level security
Users see only the rows they are entitled to.
User impersonation
Trino runs queries as the requesting user, end to end.
Fine-grained authorization
Open Policy Agent policies decide exactly who may read what.
Column masking
Sensitive fields are masked per policy at query time.
Kerberos-secured storage
HDFS access is authenticated with Kerberos.
Demo Components
The stack under the hood
Trino
Query engine
Federated SQL engine with per-user authorization and impersonation.
Open Policy Agent
Authorization
Central policy engine evaluating access decisions for the whole platform.
Keycloak
Identity
Single sign-on and user directory for every service.
Apache HDFS
Storage
Kerberos-secured distributed storage backing the queries.
Demo Workflow
From login to governed query
Installation
One command installs Trino, OPA, Keycloak and a Kerberos-secured HDFS.
Sign in as a persona
Log in as different users with different entitlements via Keycloak.
Run a query
Query the same table as each persona through Trino.
Observe filtering & masking
See rows filtered and columns masked according to OPA policy.
Inspect decisions
Review the OPA decision log to understand every access grant and denial.
Ready to run it yourself?
See how Stackable enforces one consistent security model across the whole stack.