Manage authorization with InfluxQL
Important
Authentication must be enabled before authorization can be managed.
If authentication is not enabled, permissions will not be enforced.
See “Enable authentication”.
We recommend using Chronograf and/or the Enterprise meta API to manage InfluxDB Enterprise users and roles.
Outside of creating users, we recommend operators do not mix and match InfluxQL with other authorization management methods (Chronograf and the API). Doing so may lead to inconsistencies in user permissions.
This page shows examples of basic user and permission management using InfluxQL statements. However, only a subset of Enterprise permissions can be managed with InfluxQL. Using InfluxQL, you can perform the following actions:
- Create new users and assign them either the admin role (or no role).
- grant
READand/orWRITEpermissions to users. (READ,WRITE,ALL) REVOKEpermissions from users.GRANTorREVOKEspecific database access to individual users.
However, InfluxDB Enterprise offers an expanded set of permissions. You can use the Meta API and Chronograf to access and assign these more granular permissions to individual users.
The InfluxDB Enterprise meta API provides the most comprehensive way to manage users, roles, permission and other fine grained authorization (FGA) capabilities.
Non-admin users
When authentication is enabled, a new non-admin user has no access to any database until they are specifically granted privileges to a database by an admin user.
Non-admin users can SHOW
the databases for which they have ReadData or WriteData permissions.
User management commands
User management commands apply to either admin users, non-admin users, or both.
For more information about these commands, see Database management and Continuous queries.
Manage admin users
Create an admin user with:
CREATE USER admin WITH PASSWORD '<password>' WITH ALL PRIVILEGES
Repeating the exact CREATE USER statement is idempotent.
If any values change the database will return a duplicate user error.
> CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES
> CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES
> CREATE USER todd WITH PASSWORD '123' WITH ALL PRIVILEGES
ERR: user already exists
> CREATE USER todd WITH PASSWORD '123456'
ERR: user already exists
> CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES
>
GRANT administrative privileges to an existing user
GRANT ALL PRIVILEGES TO <username>
REVOKE administrative privileges from an admin user
REVOKE ALL PRIVILEGES FROM <username>
SHOW all existing users and their admin status
SHOW USERS
CLI Example
> SHOW USERS
user admin
todd false
paul true
hermione false
dobby false
Manage non-admin users
CREATE a new non-admin user
CREATE USER <username> WITH PASSWORD '<password>'
CLI example
> CREATE USER todd WITH PASSWORD 'influxdb41yf3'
> CREATE USER alice WITH PASSWORD 'wonder\'land'
> CREATE USER "rachel_smith" WITH PASSWORD 'asdf1234!'
> CREATE USER "monitoring-robot" WITH PASSWORD 'XXXXX'
> CREATE USER "$savyadmin" WITH PASSWORD 'm3tr1cL0v3r'
Important notes about providing user credentials
- The user value must be wrapped in double quotes if
it starts with a digit, is an InfluxQL keyword, contains a hyphen,
or includes any special characters (for example:
!@#$%^&*()-). - The password string must be wrapped in single quotes.
Do not include the single quotes when authenticating requests.
We recommend avoiding the single quote (
') and backslash (\) characters in passwords. For passwords that include these characters, escape the special character with a backslash (e.g. (\') when creating the password and when submitting authentication requests. - Repeating the exact
CREATE USERstatement is idempotent. If any values change the database will return a duplicate user error.
CLI example
> CREATE USER "todd" WITH PASSWORD '123456'
> CREATE USER "todd" WITH PASSWORD '123456'
> CREATE USER "todd" WITH PASSWORD '123'
ERR: user already exists
> CREATE USER "todd" WITH PASSWORD '123456'
> CREATE USER "todd" WITH PASSWORD '123456' WITH ALL PRIVILEGES
ERR: user already exists
> CREATE USER "todd" WITH PASSWORD '123456'
>
GRANT READ, WRITE or ALL database privileges to an existing user
GRANT [READ,WRITE,ALL] ON <database_name> TO <username>
CLI examples:
GRANT READ access to todd on the NOAA_water_database database:
> GRANT READ ON "NOAA_water_database" TO "todd"
GRANT ALL access to todd on the NOAA_water_database database:
> GRANT ALL ON "NOAA_water_database" TO "todd"
REVOKE READ, WRITE, or ALL database privileges from an existing user
REVOKE [READ,WRITE,ALL] ON <database_name> FROM <username>
CLI examples:
REVOKE ALL privileges from todd on the NOAA_water_database database:
> REVOKE ALL ON "NOAA_water_database" FROM "todd"
REVOKE WRITE privileges from todd on the NOAA_water_database database:
> REVOKE WRITE ON "NOAA_water_database" FROM "todd"
If a user with ALL privileges has WRITE privileges revoked, they are left with READ privileges, and vice versa.
SHOW a user’s database privileges
SHOW GRANTS FOR <user_name>
CLI example:
> SHOW GRANTS FOR "todd"
database privilege
NOAA_water_database WRITE
another_database_name READ
yet_another_database_name ALL PRIVILEGES
one_more_database_name NO PRIVILEGES
Manage admin and non-admin users
Reset a user’s password
SET PASSWORD FOR <username> = '<password>'
CLI example:
> SET PASSWORD FOR "todd" = 'password4todd'
The password string must be wrapped in single quotes. Do not include the single quotes when authenticating requests.
We recommend avoiding the single quote (') and backslash (\) characters in passwords
For passwords that include these characters, escape the special character with a backslash (e.g. (\') when creating the password and when submitting authentication requests.
DROP a user
DROP USER <username>
CLI example:
> DROP USER "todd"
Was this page helpful?
Thank you for your feedback!
Support and feedback
Thank you for being part of our community! We welcome and encourage your feedback and bug reports for InfluxDB and this documentation. To find support, use the following resources:
Customers with an annual or support contract can contact InfluxData Support.