--- title: Manage authorization with InfluxQL description: Manage users and permissions with InfluxQL. url: https://docs.influxdata.com/enterprise_influxdb/v1/administration/manage/users-and-permissions/authorization-influxql/ estimated_tokens: 6304 product: InfluxDB Enterprise v1 version: v1 --- # Manage authorization with InfluxQL **Important** Authentication *must be enabled **before*** authorization can be managed. If authentication is not enabled, *permissions will not be enforced*. See [“Enable authentication”](/enterprise_influxdb/v1/administration/configure/security/authentication/). We recommend using [Chronograf](/chronograf/v1/administration/managing-influxdb-users/) and/or the [Enterprise meta API](/enterprise_influxdb/v1/administration/manage/users-and-permissions/authorization-api/) to manage InfluxDB Enterprise users and roles. Outside of [creating users](/enterprise_influxdb/v1/query_language/spec/#create-user), we recommend operators *do not* mix and match InfluxQL with other authorization management methods (Chronograf and the API). Doing so may lead to inconsistencies in user permissions. This page shows examples of basic user and permission management using InfluxQL statements. However, *only a subset of Enterprise permissions can be managed with InfluxQL.* Using InfluxQL, you can perform the following actions: - Create new users and assign them either the admin role (or no role). - grant `READ` and/or `WRITE` permissions to users. (`READ`, `WRITE`, `ALL`) - `REVOKE` permissions from users. - `GRANT` or `REVOKE` specific database access to individual users. However, InfluxDB Enterprise offers an [*expanded set of permissions*](/enterprise_influxdb/v1/administration/manage/users-and-permissions/permissions/#permissions). You can use the Meta API and Chronograf to access and assign these more granular permissions to individual users. The [InfluxDB Enterprise meta API](/enterprise_influxdb/v1/administration/manage/users-and-permissions/authorization-api/) provides the most comprehensive way to manage users, roles, permission and other [fine grained authorization](/enterprise_influxdb/v1/administration/manage/users-and-permissions/fine-grained-authorization/) (FGA) capabilities. #### Non-admin users When authentication is enabled, a new non-admin user has no access to any database until they are specifically [granted privileges to a database](#grant-read-write-or-all-database-privileges-to-an-existing-user) by an admin user. Non-admin users can [`SHOW`](/enterprise_influxdb/v1/query_language/explore-schema/#show-databases) the databases for which they have `ReadData` or `WriteData` permissions. ### User management commands User management commands apply to either [admin users](#manage-admin-users), [non-admin users](#manage-non-admin-users), or [both](#manage-admin-and-non-admin-users). For more information about these commands, see [Database management](/enterprise_influxdb/v1/query_language/manage-database/) and [Continuous queries](/enterprise_influxdb/v1/query_language/continuous_queries/). #### Manage admin users Create an admin user with: ```sql CREATE USER admin WITH PASSWORD '' WITH ALL PRIVILEGES ``` Repeating the exact `CREATE USER` statement is idempotent. If any values change the database will return a duplicate user error. ```sql > CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES > CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES > CREATE USER todd WITH PASSWORD '123' WITH ALL PRIVILEGES ERR: user already exists > CREATE USER todd WITH PASSWORD '123456' ERR: user already exists > CREATE USER todd WITH PASSWORD '123456' WITH ALL PRIVILEGES > ``` ##### `GRANT` administrative privileges to an existing user ```sql GRANT ALL PRIVILEGES TO ``` ##### `REVOKE` administrative privileges from an admin user ```sql REVOKE ALL PRIVILEGES FROM ``` ##### `SHOW` all existing users and their admin status ```sql SHOW USERS ``` ###### CLI Example ```sql > SHOW USERS user admin todd false paul true hermione false dobby false ``` #### Manage non-admin users ##### `CREATE` a new non-admin user ```sql CREATE USER WITH PASSWORD '' ``` ###### CLI example ```js CREATE USER todd WITH PASSWORD 'influxdb41yf3' CREATE USER alice WITH PASSWORD 'wonder\'land' CREATE USER "rachel_smith" WITH PASSWORD 'asdf1234!' CREATE USER "monitoring-robot" WITH PASSWORD 'XXXXX' CREATE USER "$savyadmin" WITH PASSWORD 'm3tr1cL0v3r' ``` ##### Important notes about providing user credentials - The user value must be wrapped in double quotes if it starts with a digit, is an InfluxQL keyword, contains a hyphen, or includes any special characters (for example: `!@#$%^&*()-`). - The password [string](/influxdb/v1/query_language/spec/#strings) must be wrapped in single quotes. Do not include the single quotes when authenticating requests. We recommend avoiding the single quote (`'`) and backslash (`\`) characters in passwords. For passwords that include these characters, escape the special character with a backslash (e.g. (`\'`) when creating the password and when submitting authentication requests. - Repeating the exact `CREATE USER` statement is idempotent. If any values change the database will return a duplicate user error. ###### CLI example ```sql > CREATE USER "todd" WITH PASSWORD '123456' > CREATE USER "todd" WITH PASSWORD '123456' > CREATE USER "todd" WITH PASSWORD '123' ERR: user already exists > CREATE USER "todd" WITH PASSWORD '123456' > CREATE USER "todd" WITH PASSWORD '123456' WITH ALL PRIVILEGES ERR: user already exists > CREATE USER "todd" WITH PASSWORD '123456' > ``` ##### `GRANT` `READ`, `WRITE` or `ALL` database privileges to an existing user ```sql GRANT [READ,WRITE,ALL] ON TO ``` CLI examples: `GRANT` `READ` access to `todd` on the `NOAA_water_database` database: ```sql GRANT READ ON "NOAA_water_database" TO "todd" ``` `GRANT` `ALL` access to `todd` on the `NOAA_water_database` database: ```sql GRANT ALL ON "NOAA_water_database" TO "todd" ``` ##### `REVOKE` `READ`, `WRITE`, or `ALL` database privileges from an existing user ``` REVOKE [READ,WRITE,ALL] ON FROM ``` CLI examples: `REVOKE` `ALL` privileges from `todd` on the `NOAA_water_database` database: ```sql REVOKE ALL ON "NOAA_water_database" FROM "todd" ``` `REVOKE` `WRITE` privileges from `todd` on the `NOAA_water_database` database: ```sql REVOKE WRITE ON "NOAA_water_database" FROM "todd" ``` If a user with `ALL` privileges has `WRITE` privileges revoked, they are left with `READ` privileges, and vice versa. ##### `SHOW` a user’s database privileges ```sql SHOW GRANTS FOR ``` CLI example: ```sql > SHOW GRANTS FOR "todd" database privilege NOAA_water_database WRITE another_database_name READ yet_another_database_name ALL PRIVILEGES one_more_database_name NO PRIVILEGES ``` #### Manage admin and non-admin users ##### Reset a user’s password ```sql SET PASSWORD FOR = '' ``` CLI example: ```sql SET PASSWORD FOR "todd" = 'password4todd' ``` The password [string](/influxdb/v1/query_language/spec/#strings) must be wrapped in single quotes. Do not include the single quotes when authenticating requests. We recommend avoiding the single quote (`'`) and backslash (`\`) characters in passwords For passwords that include these characters, escape the special character with a backslash (e.g. (`\'`) when creating the password and when submitting authentication requests. ##### `DROP` a user ```sql DROP USER ``` CLI example: ```sql DROP USER "todd" ``` #### Related - [Manage InfluxDB users in Chronograf](/chronograf/v1/administration/managing-influxdb-users/)