Add Trino integration documentation and configuration options for PDP (#593)

* Add Trino integration documentation and configuration options for PDP

* Update Trino integration documentation with specific file paths and additional security guidance

* Apply suggestions from code review

Co-authored-by: Or Weis <[email protected]>

* improve trino docs

---------

Co-authored-by: Zeev Manilovich <[email protected]>
Co-authored-by: Or Weis <[email protected]>
Co-authored-by: Zeev Manilovich <[email protected]>

Author: 3 people

docs/concepts/pdp/configuration.mdx

@@ -291,6 +291,31 @@ Default: `False`
 
 If true, the `/metrics` endpoint will be accessible without authentication.
 
+#### PDP_ALLOW_UNAUTHENTICATED_TRINO
+
+Default: `False`
+
+Expose the Trino authorization endpoints without requiring PDP authentication. When enabled, clients can reach the Trino routes without presenting an API key.
+
+:::warning Warning:
+Trino does not currently support passing an API key or credentials when calling external authorization endpoints. 
+As a result, you must expose the PDP's Trino authorization routes (such as `/trino/allowed`, `/trino/row-filter`, `/trino/batch-column-masking`) without authentication, by setting `PDP_ALLOW_UNAUTHENTICATED_TRINO=True`.
+
+Because these endpoints are unauthenticated, **do not expose your PDP** to the public internet or any untrusted networks. 
+Always deploy the PDP behind a firewall or within a secure, trusted network accessible only by the Trino cluster. 
+
+For more information, follow the [Trino issue](https://github.com/trinodb/trino/issues/27022) on this topic.
+:::
+
+#### PDP_TRINO_AUTHZ_CONFIG_PATH
+
+Default: `/app/config/trino-authz.yaml`
+
+Absolute path to the YAML file that defines Trino row filters and column masking policies loaded by the PDP. 
+If the file is absent or fails to parse, the PDP starts without additional Trino authorization rules.
+
+For more information, see the [Trino integration documentation](/integrations/database-access-control/trino-integration#pdp-trino-config-file).
+
 #### PDP_LOCAL_FACTS_WAIT_TIMEOUT
 
 Default: `10`

docs/integrations/database-access-control/_category_.json

@@ -0,0 +1,7 @@
+{
+  "label": "Database-level Authorization",
+  "position": 1,
+  "collapsed": false,
+  "collapsible": true
+}
+