Documentation

Set up internal Kapacitor authorizations

Use user-based authorizations and permissions stored in Kapacitor to authenticate requests to the Kapacitor HTTP API.

Use Kapacitor authorizations

  1. Create an admin user:

    1. Set the following in the [auth] configuration group in your kapacitor.conf:

      • enabled: true
      • bcrypt: an integer greater than or equal to 4
      • meta-*: empty string or false
      [auth]
        enabled = true
        cache-expiration = "1h"
        bcrypt-cost = 4
        meta-addr = ""
        meta-username = ""
        meta-password = ""
        meta-use-tls = false
        meta-ca = ""
        meta-cert = ""
        meta-key = ""
        meta-insecure-skip-verify = false
      

      Or use environment variables to set these configuration options:

      export KAPACITOR_AUTH_ENABLED=true
      export KAPACITOR_AUTH_BCRYPT=4
      
    2. Start kapacitord using the updated configuration:

      kapactord -config /path/to/kapacitor.conf
      
    3. Use the /users endpoint of the Kapacitor HTTP API to create a new admin user. In the request body, provide a JSON object with the following fields:

      • name: admin username
      • password: admin password
      • type: "admin"
      curl --request POST 'http://localhost:9092/kapacitor/v1/users' \
        --data '{
          "name": "exampleUsername",
          "password": "examplePassword",
          "type":"admin"
      }'
      
  2. Stop the kapacitord service.

  3. Set [http].auth-enabled to true in your kapacitor.conf:

    [http]
      #...
      auth-enabled: true
      #...
    

    Or use the KAPACITOR_HTTP_AUTH_ENABLED environment variable:

    export KAPACITOR_HTTP_AUTH_ENABLED=true
    
  4. Restart kapacitord with the updated configuration.

    kapacitord -config /path/to/kapacitor.conf
    
  5. (Optional) Create additional users with user-specific permissions. For more information, see:

Authenticate with the Kapacitor CLI

To authenticate with Kapacitor when using the kapacitor CLI, provide your username and password as part of the Kapacitor -url:

# Syntax
kapacitor -url http://<username>:<password>@localhost:9092

# Example
kapacitor -url http://admin:Pa5sw0Rd@localhost:9092

Authenticate with the Kapacitor API

To authenticate directly with the Kapacitor API, use basic authentication to provide your username and password.

# Syntax
curl --request GET http://localhost:9092/kapacitor/v1/tasks \
  -u "<username>:<password>" 

# Example
curl --request GET http://localhost:9092/kapacitor/v1/tasks \
  -u "johndoe:Pa5sw0Rd" 

Upgrade to InfluxDB Cloud or InfluxDB 2.0!

InfluxDB Cloud and InfluxDB OSS 2.0 ready for production.