You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CREATE [ OR REPLACE ] USER <name> IDENTIFIED [ WITH <auth_type> ] BY '<password>'
21
20
[ WITH MUST_CHANGE_PASSWORD = true | false ]
22
-
[ WITH SET PASSWORD POLICY ='<policy_name>' ] -- Set password policy
23
-
[ WITH SET NETWORK POLICY ='<policy_name>' ] -- Set network policy
24
-
[ WITH SET WORKLOAD GROUP ='<workload_group_name>' ] -- Set workload group
25
-
[ WITH DEFAULT_ROLE ='<role_name>' ] -- Set default role
26
-
[ WITH DISABLED = true | false ] -- User created in a disabled state
21
+
[ WITH SET PASSWORD POLICY ='<policy_name>' ]
22
+
[ WITH SET NETWORK POLICY ='<policy_name>' ]
23
+
[ WITH DEFAULT_ROLE ='<role_name>' ]
24
+
[ WITH DISABLED = true | false ]
27
25
```
28
26
29
-
- The `<name>` cannot contain the following illegal characters:
30
-
- Single quote (')
31
-
- Double quote (")
32
-
- Backspace (\b)
33
-
- Form feed (\f)
34
-
-*auth_type* can be `double_sha1_password` (default), `sha256_password` or `no_password`.
35
-
- When `MUST_CHANGE_PASSWORD` is set to `true`, the new user must change password at first login. Users can change their own password using the [ALTER USER](03-user-alter-user.md) command.
36
-
- When you set a default role for a user using CREATE USER or [ALTER USER](03-user-alter-user.md), Databend does not verify the role's existence or automatically grant the role to the user. You must explicitly grant the role to the user for the role to take effect.
37
-
- When `DISABLED` is set to `true`, the new user is created in a disabled state. Users in this state cannot log in to Databend until they are enabled. To enable or disable a created user, use the [ALTER USER](03-user-alter-user.md) command.
27
+
**Parameters:**
28
+
-`<name>`: Username (cannot contain single quotes, double quotes, backspace, or form feed characters)
29
+
-`<auth_type>`: Authentication type - `double_sha1_password` (default), `sha256_password`, or `no_password`
30
+
-`MUST_CHANGE_PASSWORD`: When `true`, user must change password at first login
31
+
-`DEFAULT_ROLE`: Sets default role (role must be explicitly granted to take effect)
32
+
-`DISABLED`: When `true`, user is created in disabled state and cannot log in
38
33
39
34
## Examples
40
35
41
-
### Example 1: Creating User with Default auth_type
2 rows read in0.015 sec. Processed 0 rows, 0 B (0 rows/s, 0 B/s)
121
-
```
122
-
123
-
### Example 5: Creating User in Disabled State
124
-
125
-
This example creates a user named 'u1' in a disabled state, preventing login access. After enabling the user using the [ALTER USER](03-user-alter-user.md) command, login access is restored.
126
-
127
-
1. Create a user named 'u1' in the disabled state:
128
-
48
+
Verify the user and permissions:
129
49
```sql
130
-
CREATEUSERu1 IDENTIFIED BY '123' WITH DISABLED = TRUE;
2. Attempt to connect to Databend using BendSQL as user 'u1', resulting in an authentication error:
58
+
### Example 2: Create User and Grant Role
143
59
144
-
```shell
145
-
➜ ~ bendsql --user u1 --password 123
146
-
Welcome to BendSQL 0.16.0-homebrew.
147
-
Connecting to localhost:8000 as user u1.
148
-
Error: APIError: RequestError: Start Query failed with status 401 Unauthorized: {"error":{"code":"401","message":"AuthenticateFailure: user u1 is disabled. Not allowed to login"}}
149
-
```
150
-
151
-
3. Enable the user 'u1' with the [ALTER USER](03-user-alter-user.md) command:
60
+
Create a user and assign a role with specific privileges:
152
61
153
62
```sql
154
-
ALTERUSER u1 WITH DISABLED = FALSE;
63
+
-- Create a role with specific privileges
64
+
CREATE ROLE analyst_role;
65
+
GRANTSELECTON*.* TO ROLE analyst_role;
66
+
GRANT INSERT ON default.* TO ROLE analyst_role;
67
+
68
+
-- Create user and grant the role
69
+
CREATEUSERjohn_analyst IDENTIFIED BY 'secure_pass456';
70
+
GRANT ROLE analyst_role TO john_analyst;
155
71
```
156
72
157
-
4. Re-attempt connection to Databend as user 'u1', confirming successful login access:
158
-
159
-
```shell
160
-
➜ ~ bendsql --user u1 --password 123
161
-
Welcome to BendSQL 0.16.0-homebrew.
162
-
Connecting to localhost:8000 as user u1.
163
-
Connected to Databend Query v1.2.424-nightly-d3a89f708d(rust-1.77.0-nightly-2024-04-17T22:11:59.304509266Z)
73
+
Verify the role assignment:
74
+
```sql
75
+
SHOW GRANTS FOR john_analyst;
76
+
+------------------------------------------+
77
+
| Grants |
78
+
+------------------------------------------+
79
+
| GRANTSELECTON*.* TO 'analyst_role' |
80
+
| GRANT INSERT ON'default'.* TO 'analyst_role' |
81
+
+------------------------------------------+
164
82
```
165
83
166
-
### Example 6: Creating User with MUST_CHANGE_PASSWORD
167
-
168
-
In this example, we will create a user with the `MUST_CHANGE_PASSWORD` option. Then, we will connect to Databend with BendSQL as the new user and change the password.
169
-
170
-
1. Create a new user named 'eric' with the `MUST_CHANGE_PASSWORD` option set to `TRUE`.
84
+
### Example 3: Create Users with Different Authentication Types
171
85
172
86
```sql
173
-
CREATEUSEReric IDENTIFIED BY 'abc123' WITH MUST_CHANGE_PASSWORD = TRUE;
174
-
```
175
-
176
-
2. Launch BendSQL and connect to Databend as the new user. Once connected, you'll see a message indicating that a password change is required.
87
+
-- Create user with default authentication
88
+
CREATEUSERuser1 IDENTIFIED BY 'abc123';
177
89
178
-
```bash
179
-
MacBook-Air:~ eric$ bendsql -ueric -pabc123
90
+
-- Create user with SHA256 authentication
91
+
CREATEUSERuser2 IDENTIFIED WITH sha256_password BY 'abc123';
180
92
```
181
93
182
-
3. Change the password with the [ALTER USER](03-user-alter-user.md) command.
183
-
184
-
```bash
185
-
eric@localhost:8000/default> ALTER USER USER() IDENTIFIED BY 'abc456';
186
-
```
94
+
### Example 4: Create Users with Special Configurations
187
95
188
-
4. Quit BendSQL then reconnect with the new password.
96
+
```sql
97
+
-- Create user with password change requirement
98
+
CREATEUSERnew_employee IDENTIFIED BY 'temp123' WITH MUST_CHANGE_PASSWORD = true;
189
99
190
-
```bash
191
-
MacBook-Air:~ eric$ bendsql -ueric -pabc456
192
-
Welcome to BendSQL 0.19.2-1e338e1(2024-07-17T09:02:28.323121000Z).
193
-
Connecting to localhost:8000 as user eric.
194
-
Connected to Databend Query v1.2.567-nightly-78d41aedc7(rust-1.78.0-nightly-2024-07-14T22:10:13.777450105Z)
100
+
-- Create user in disabled state
101
+
CREATEUSERtemp_user IDENTIFIED BY 'abc123' WITH DISABLED = true;
195
102
196
-
eric@localhost:8000/default>
103
+
-- Create user with default role (role must be granted separately)
104
+
CREATEUSERmanager IDENTIFIED BY 'abc123' WITH DEFAULT_ROLE ='admin';
0 commit comments