Documentation

InfluxDB Clustered

Add a user to your InfluxDB cluster

Add a user with administrative access to your InfluxDB cluster through your identity provider and your InfluxDB AppInstance resource:

  1. Use your identity provider to create an OAuth2 account for the user that needs administrative access to your InfluxDB cluster.

    Refer to your identity provider’s documentation for information about adding users:

  2. Add the user to your InfluxDB AppInstance resource. You can edit your AppInstance resource directly in your myinfluxdb.yml, or, if you’re using the InfluxDB Clustered Helm chart, you can add users to your values.yaml to modify your AppInstance resource. Required credentials depend on your identity provider.

    AppInstance Helm

    If editing your AppInstance resource directly, provide values for the following fields in your myinfluxdb.yml configuration file:

    • spec.package.spec.admin
      • identityProvider: Identity provider name. If using Microsoft Entra ID (formerly Azure Active Directory), set the name to azure.
      • jwksEndpoint: JWKS endpoint provide by your identity provider.
      • users: List of OAuth2 users to grant administrative access to your InfluxDB cluster. IDs are provided by your identity provider.

    Below are examples for Keycloak, Auth0, and Microsoft Entra ID, but other OAuth2 providers should work as well:

    Keycloak Auth0 Microsoft Entra ID

    apiVersion: kubecfg.dev/v1alpha1
kind: AppInstance
# ...
spec:
  package:
    spec:
      admin:
        identityProvider: keycloak
        jwksEndpoint: |-
          https://
    KEYCLOAK_HOST
    /auth/realms/
    KEYCLOAK_REALM
    /protocol/openid-connect/certs    
            users:
          # All fields are required but `firstName`, `lastName`, and `email` can be
          # arbitrary values. However, `id` must match the user ID provided by Keycloak.
          - id: 
    KEYCLOAK_USER_ID
    
                firstName: Marty
            lastName: McFly
            email: mcfly@influxdata.com
    • Copy
    • Fill window

    Replace the following:

    • KEYCLOAK_HOST: Host and port of your Keycloak server
    • KEYCLOAK_REALM: Keycloak realm
    • KEYCLOAK_USER_ID: Keycloak user ID to grant InfluxDB administrative access to (See Find user IDs with Keycloak)
    apiVersion: kubecfg.dev/v1alpha1
kind: AppInstance
# ...
spec:
  package:
    spec:
      admin:
        identityProvider: auth0
        jwksEndpoint: |-
          https://
    AUTH0_HOST
    /.well-known/openid-configuration    
            users:
          # All fields are required but `firstName`, `lastName`, and `email` can be
          # arbitrary values. However, `id` must match the user ID provided by Auth0.
          - id: 
    AUTH0_USER_ID
    
                firstName: Marty
            lastName: McFly
            email: mcfly@influxdata.com
    • Copy
    • Fill window

    Replace the following:

    • AUTH0_HOST: Host and port of your Auth0 server
    • AUTH0_USER_ID: Auth0 user ID to grant InfluxDB administrative access to
    apiVersion: kubecfg.dev/v1alpha1
kind: AppInstance
# ...
spec:
  package:
    spec:
      admin:
        identityProvider: azure
        jwksEndpoint: |-
          https://login.microsoftonline.com/
    AZURE_TENANT_ID
    /discovery/v2.0/keys    
            users:
          # All fields are required but `firstName`, `lastName`, and `email` can be
          # arbitrary values. However, `id` must match the user ID provided by Azure.
          - id: 
    AZURE_USER_ID
    
                firstName: Marty
            lastName: McFly
            email: mcfly@influxdata.com
    • Copy
    • Fill window

    Replace the following:

    If using the InfluxDB Clustered Helm chart, provide values for the following fields in your values.yaml:

    • admin
      • identityProvider: Identity provider name. If using Microsoft Entra ID (formerly Azure Active Directory), set the name to azure.
      • jwksEndpoint: JWKS endpoint provide by your identity provider.
      • users: List of OAuth2 users to grant administrative access to your InfluxDB cluster. IDs are provided by your identity provider.

    Below are examples for Keycloak, Auth0, and Microsoft Entra ID, but other OAuth2 providers should work as well:

    Keycloak Auth0 Microsoft Entra ID

    admin:
  # The identity provider to be used (such as "keycloak", "auth0", or "azure")
  # Note, use "azure" for Azure Active Directory
  identityProvider: keycloak
  # The JWKS endpoint provided by the Identity Provider
  jwksEndpoint: |-
    https://
    KEYCLOAK_HOST
    /auth/realms/
    KEYCLOAK_REALM
    /protocol/openid-connect/certs    
      # The list of users to grant access to Clustered via influxctl
  users:
    # All fields are required but `firstName`, `lastName`, and `email` can be
    # arbitrary values. However, `id` must match the user ID provided by Keycloak.
    - id: 
    KEYCLOAK_USER_ID
    
          firstName: Marty
      lastName: McFly
      email: mcfly@influxdata.com
    • Copy
    • Fill window

    Replace the following:

    • KEYCLOAK_HOST: Host and port of your Keycloak server
    • KEYCLOAK_REALM: Keycloak realm
    • KEYCLOAK_USER_ID: Keycloak user ID to grant InfluxDB administrative access to
    admin:
  # The identity provider to be used e.g. "keycloak", "auth0", "azure", etc
  # Note, use "azure" for Azure Active Directory.
  identityProvider: auth0
  # The JWKS endpoint provided by the Identity Provider
  jwksEndpoint: |-
    https://
    AUTH0_HOST
    /.well-known/openid-configuration    
      # The list of users to grant access to Clustered via influxctl
  users:
    # All fields are required but `firstName`, `lastName`, and `email` can be
    # arbitrary values. However, `id` must match the user ID provided by Auth0.
    - id: 
    AUTH0_USER_ID
    
          firstName: Marty
      lastName: McFly
      email: mcfly@influxdata.com
    • Copy
    • Fill window

    Replace the following:

    • AUTH0_HOST: Host and port of your Auth0 server
    • AUTH0_USER_ID: Auth0 user ID to grant InfluxDB administrative access to
    admin:
  # The identity provider to be used e.g. "keycloak", "auth0", "azure", etc
  # Note, use "azure" for Azure Active Directory.
  identityProvider: azure
  # The JWKS endpoint provided by the Identity Provider
  jwksEndpoint: |-
    https://login.microsoftonline.com/
    AZURE_TENANT_ID
    /discovery/v2.0/keys    
      # The list of users to grant access to Clustered via influxctl
  users:
    # All fields are required but `firstName`, `lastName`, and `email` can be
    # arbitrary values. However, `id` must match the user ID provided by Azure.
    - id: 
    AZURE_USER_ID
    
          firstName: Marty
      lastName: McFly
      email: mcfly@influxdata.com
    • Copy
    • Fill window

    Replace the following:

  3. Apply the change to your InfluxDB cluster.

    • If updating the AppInstance resource directly, use kubectl to apply the change.
    • If using the InfluxDB Clustered Helm chart, use helm to apply the change.

kubectl Helm

kubectl apply \
  --filename myinfluxdb.yml \
  --namespace influxdb
  • Copy
  • Fill window
helm upgrade \
  influxdb \
  influxdata/influxdb3-clustered \
  -f ./values.yaml \
  --namespace influxdb
  • Copy
  • Fill window

Once applied, the added user is granted administrative access to your InfluxDB cluster and can use influxctl to perform administrative actions. See Set up Authorization–Configure influxctl for information about configuring the new user’s influxctl client to communicate and authenticate with your InfluxDB cluster’s identity provider.

Was this page helpful?

Thank you for your feedback!

© 2025 InfluxData, Inc.

What is your InfluxDB cluster URL?

Enter your InfluxDB cluster URL and we’ll update code examples for you.

Enter cluster URL

Thank you for your feedback!

Let us know what we can do better:

Thank you!

No thanks

The future of Flux

Flux is going into maintenance mode. You can continue using it as you currently are without any changes to your code.

Read more

InfluxDB 3 Core and Enterprise are now in Beta

InfluxDB 3 Core and Enterprise are now available for beta testing, available under MIT or Apache 2 license.

InfluxDB 3 Core is a high-speed, recent-data engine that collects and processes data in real-time, while persisting it to local disk or object storage. InfluxDB 3 Enterprise is a commercial product that builds on Core’s foundation, adding high availability, read replicas, enhanced security, and data compaction for faster queries. A free tier of InfluxDB 3 Enterprise will also be available for at-home, non-commercial use for hobbyists to get the full historical time series database set of capabilities.

For more information, check out:

Ask AI