Skip to content

Latest commit

 

History

History
130 lines (85 loc) · 5.36 KB

create-user.md

File metadata and controls

130 lines (85 loc) · 5.36 KB
title summary toc
CREATE USER
The CREATE USER statement creates SQL users, which let you control privileges on your databases and tables.
false

The CREATE USER statement creates SQL users, which let you control privileges on your databases and tables.

{{site.data.alerts.callout_success}}You can also use the cockroach user set command to create and manage users.{{site.data.alerts.end}}

Considerations

Required Privileges

The user must have the INSERT and UPDATE privileges on the system.users table.

Synopsis

{% include sql/{{ page.version.version }}/diagrams/create_user.html %}

Parameters

<style> table td:first-child { min-width: 225px; } </style>
Parameter Description
user_name The name of the user you want to create.

Usernames are case-insensitive; must start with either a letter or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters.
password Let the user authenticate their access to a secure cluster using this password. Passwords must be entered as string values surrounded by single quotes (').

Changed in v2.0: Password creation is supported only in secure clusters for non-root users. The root user must authenticate with a client certificate and key.

User Authentication

Secure clusters require users to authenticate their access to databases and tables. CockroachDB offers two methods for this:

  • Client certificate and key authentication, which is available to all users. To ensure the highest level of security, we recommend only using client certificate and key authentication.

  • Password authentication, which is available to non-root users who you've created passwords for. To create a user with a password, use the WITH PASSWORD clause of CREATE USER. To add a password to an existing user, use the cockroach user command.

    Users can use passwords to authenticate without supplying client certificates and keys; however, we recommend using certificate-based authentication whenever possible.

    Changed in v2.0: Password creation is supported only in secure clusters.

Examples

Create a User

Usernames are case-insensitive; must start with either a letter or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters.

> CREATE USER jpointsman;

After creating users, you must:

Create a User With a Password

> CREATE USER jpointsman WITH PASSWORD 'Q7gc8rEdS';

Changed in v2.0: Password creation is supported only in secure clusters for non-root users. The root user must authenticate with a client certificate and key.

Manage Users

After creating users, you can manage them using the cockroach user command.

Authenticate as a Specific User

Secure Insecure

Secure Clusters with Client Certificates

All users can authenticate their access to a secure cluster using a client certificate issued to their username.

$ cockroach sql --user=jpointsman

Secure Clusters with Passwords

Users with passwords can authenticate their access by entering their password at the command prompt instead of using their client certificate and key.

If we cannot find client certificate and key files matching the user, we fall back on password authentication.

$ cockroach sql --user=jpointsman
$ cockroach sql --insecure --user=jpointsman

See Also