Create & Manage Users

On this page

To create, manage, and remove your cluster's users (which lets you control SQL-level privileges), use the cockroach user command with appropriate flags.

Considerations

• Usernames are case-insensitive; must start with either a letter or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters.
• After creating users, you must grant them privileges to databases and tables.
• On secure clusters, you must create client certificates for users and users must authenticate their access to the cluster.
• Removing a user does not remove that user's privileges. Therefore, to prevent a future user with an identical username from inheriting an old user's privileges, it's important to revoke a user's privileges before or after removing the user.

Subcommands

Synopsis

# Create a user:
$ cockroach user set <username> <flags>

# List all users:
$ cockroach user ls <flags>

# Display a specific user:
$ cockroach user get <username> <flags>

# View help:
$ cockroach user --help
$ cockroach user get --help
$ cockroach user ls --help
$ cockroach user rm --help
$ cockroach user set --help

Flags

The user command and subcommands support the following general-use and logging flags.

General

Logging

By default, the user command logs errors to stderr.

If you need to troubleshoot this command's behavior, you can change its logging behavior.

User Authentication

Secure clusters require users to authenticate their access to databases and tables. CockroachDB offers two methods for this:

• Client certificate and key authentication, which is available to all users. To ensure the highest level of security, we recommend only using client certificate and key authentication.
• Password authentication, which is available only to users who you've created passwords for. To set a password for a user, include the --password flag in the cockroach user set command. However, you cannot add password authentication to the root user.
  
  You can use this password to authenticate users without supplying their client certificate and key; however, we recommend instead using client certificate and key authentication whenever possible.

Examples

Create a User

Insecure Cluster

$ cockroach user set jpointsman --insecure

Usernames are case-insensitive; must start with either a letter or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters.

After creating users, you must grant them privileges to databases.

Secure Cluster

$ cockroach user set jpointsman --certs-dir=certs

Usernames are case-insensitive; must start with either a letter or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters.

After creating users, you must:

• Create their client certificates.
• Grant them privileges to databases.

Authenticate as a Specific User

Insecure Clusters

$ cockroach sql --insecure --user=jpointsman

Secure Clusters with Client Certificates

All users can authenticate their access to a secure cluster using a client certificate issued to their username.

$ cockroach sql --certs-dir=certs --user=jpointsman

Secure Clusters with Passwords

Users with passwords can authenticate their access by entering their password at the command prompt instead of using their client certificate and key.

If we cannot find client certificate and key files matching the user, we fall back on password authentication.

$ cockroach sql --certs-dir=certs --user=jpointsman

Update a User's Password

$ cockroach user set jpointsman --certs-dir=certs --password

After issuing this command, enter and confirm the user's new password at the command prompt.

List All Users

$ cockroach user ls --insecure

+------------+
|  username  |
+------------+
| jpointsman |
+------------+

Find a Specific User

$ cockroach user get jpointsman --insecure

+------------+--------------------------------------------------------------+
|  username  |                        hashedPassword                        |
+------------+--------------------------------------------------------------+
| jpointsman | $2a$108tm5lYjES9RSXSKtQFLhNO.e/ysTXCBIRe7XeTgBrR6ubXfp6dDczS |
+------------+--------------------------------------------------------------+

Remove a User

$ cockroach user rm jpointsman --insecure

See Also

• Create Security Certificates
• GRANT
• SHOW GRANTS
• CREATE USER
• Other Cockroach Commands

Was this helpful?