Manage authorization with InfluxQL

This page shows examples of basic user and permission management using InfluxQL statements. However, only a subset of Enterprise permissions can be managed with InfluxQL. Using InfluxQL, you can perform the following actions:

• Create new users and assign them either the admin role (or no role).
• grant READ and/or WRITE permissions to users. (READ, WRITE, ALL)
• REVOKE permissions from users.
• GRANT or REVOKE specific database access to individual users.

However, InfluxDB Enterprise offers an expanded set of permissions. You can use the Meta API and Chronograf to access and assign these more granular permissions to individual users.

The InfluxDB Enterprise meta API provides the most comprehensive way to manage users, roles, permission and other fine grained authorization (FGA) capabilities.

Non-admin users

When authentication is enabled, a new non-admin user has no access to any database until they are specifically granted privileges to a database by an admin user.

Non-admin users can SHOW the databases for which they have ReadData or WriteData permissions.

User management commands

User management commands apply to either admin users, non-admin users, or both.

For more information about these commands, see Database management and Continuous queries.

Manage admin users

Create an admin user with:

CREATE USER admin WITH PASSWORD '<password>' WITH ALL PRIVILEGES

> CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES
> CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES
> CREATE USER todd WITH PASSWORD '123' WITH ALL PRIVILEGES
ERR: user already exists
> CREATE USER todd WITH PASSWORD '123456'
ERR: user already exists
> CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES
>

GRANT administrative privileges to an existing user

GRANT ALL PRIVILEGES TO <username>

REVOKE administrative privileges from an admin user

REVOKE ALL PRIVILEGES FROM <username>

SHOW all existing users and their admin status

SHOW USERS

CLI Example

> SHOW USERS
user 	   admin
todd     false
paul     true
hermione false
dobby    false

Manage non-admin users

CREATE a new non-admin user

CREATE USER <username> WITH PASSWORD '<password>'

CLI example

CREATE USER todd WITH PASSWORD 'influxdb41yf3'
CREATE USER alice WITH PASSWORD 'wonder\'land'
CREATE USER "rachel_smith" WITH PASSWORD 'asdf1234!'
CREATE USER "monitoring-robot" WITH PASSWORD 'XXXXX'
CREATE USER "$savyadmin" WITH PASSWORD 'm3tr1cL0v3r'

> CREATE USER "todd" WITH PASSWORD '123456'
> CREATE USER "todd" WITH PASSWORD '123456'
> CREATE USER "todd" WITH PASSWORD '123'
ERR: user already exists
> CREATE USER "todd" WITH PASSWORD '123456'
> CREATE USER "todd" WITH PASSWORD '123456' WITH ALL PRIVILEGES
ERR: user already exists
> CREATE USER "todd" WITH PASSWORD '123456'
>

GRANT READ, WRITE or ALL database privileges to an existing user

GRANT [READ,WRITE,ALL] ON <database_name> TO <username>

CLI examples:

GRANT READ access to todd on the NOAA_water_database database:

GRANT READ ON "NOAA_water_database" TO "todd"

GRANT ALL access to todd on the NOAA_water_database database:

GRANT ALL ON "NOAA_water_database" TO "todd"

REVOKE READ, WRITE, or ALL database privileges from an existing user

REVOKE [READ,WRITE,ALL] ON <database_name> FROM <username>

CLI examples:

REVOKE ALL privileges from todd on the NOAA_water_database database:

REVOKE ALL ON "NOAA_water_database" FROM "todd"

REVOKE WRITE privileges from todd on the NOAA_water_database database:

REVOKE WRITE ON "NOAA_water_database" FROM "todd"

SHOW a user’s database privileges

SHOW GRANTS FOR <user_name>

CLI example:

> SHOW GRANTS FOR "todd"
database		            privilege
NOAA_water_database	        WRITE
another_database_name	    READ
yet_another_database_name   ALL PRIVILEGES
one_more_database_name      NO PRIVILEGES

Manage admin and non-admin users

Reset a user’s password

SET PASSWORD FOR <username> = '<password>'

CLI example:

SET PASSWORD FOR "todd" = 'password4todd'

DROP a user

DROP USER <username>

CLI example:

DROP USER "todd"