Manage users and authentication
User authentication is a preview feature
Multi-user authentication is available as a preview in InfluxDB 3 Enterprise
3.10 and is off by default. Existing apiv3_ token workflows are
unaffected. The following known limitations apply:
influxdb3 auth logoutremoves local credentials but does not revoke the issued JWT server-side.- A non-admin user can currently create tokens with broader permissions than their assigned role.
- Role-based permissions are limited and still being finalized. Only the Admin role (or an admin token) currently has full access. The Auditor and Member roles grant less access than their names suggest. Use an admin token for user and role management.
Multi-user authentication lets users log in to InfluxDB 3 Enterprise with
individual credentials that issue JSON Web Tokens (JWTs), with access governed by
role-based access control (RBAC).
It complements–but doesn’t replace–apiv3_
token authentication.
Enable user authentication
User authentication is off by default (--without-user-auth true).
To enable it, start the server with --without-user-auth false:
influxdb3 serve --without-user-auth falseFor the complete list of authentication serve flags, see the
influxdb3 serve CLI
reference.
Configure JWT signing keys
User authentication signs JWTs with an RSA private key that must be in PKCS#1 format. Generate a compatible key with the -traditional flag:
openssl genrsa -traditional -out jwt-private-key.pem 2048Use PKCS#1 keys, not PKCS#8
A PKCS#8 key (the default openssl genrsa output without -traditional)
silently fails to sign tokens. Always generate the key with
openssl genrsa -traditional.
Bootstrap the initial admin
After enabling user authentication, create the initial admin user and operator
token with influxdb3 manage init-admin:
influxdb3 manage init-adminFor complete syntax, see the
influxdb3 manage CLI
reference.
Log in and out
Users authenticate with influxdb3 auth login and end their session with
influxdb3 auth logout:
influxdb3 auth loginCredentials are stored at ~/.influxdb3/credentials.json and refreshed
automatically.
influxdb3 auth logout removes the local credentials but does not revoke
the issued JWT server-side. The token remains valid until it expires.
Optional: Authenticate with OAuth/OIDC
You can optionally delegate authentication to an OAuth/OIDC identity provider
using the --oauth-* serve flags (for example, --oauth-issuer,
--oauth-client-id). See the
influxdb3 serve CLI
reference for the full set of OAuth flags.
Roles
InfluxDB 3 Enterprise includes three built-in roles–Admin, Auditor, and Member. Assign roles to users to control what they can do. For details on each role and the permissions model, see Role-based access control (RBAC).
Authoring custom roles is not available in InfluxDB 3.10. Use the built-in roles.
Was this page helpful?
Thank you for your feedback!
Support and feedback
Thank you for being part of our community! We welcome and encourage your feedback and bug reports for InfluxDB 3 Enterprise and this documentation. To find support, use the following resources:
Customers with an annual or support contract can contact InfluxData Support. Customers using a trial license can email trial@influxdata.com for assistance.