The CREATE USER statement creates SQL users, which let you control privileges on your databases and tables.
Considerations
- Usernames:
- Are case-insensitive
- Must start with a letter, number, or underscore
- Must contain only letters, numbers, or underscores
- Must be between 1 and 63 characters.
- After creating users, you must grant them privileges to databases and tables.
- All users belong to the
publicrole, to which you can grant and revoke privileges. - On secure clusters, you must create client certificates for users and users must authenticate their access to the cluster.
Required privileges
The user must have the INSERT and UPDATE privileges on the system.users table.
Synopsis
Parameters
| Parameter | Description |
|---|---|
user_name |
The name of the user you want to create. Usernames are case-insensitive; must start with a letter, number, or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters. |
password |
Let the user authenticate their access to a secure cluster using this password. Passwords must be entered as string values surrounded by single quotes (').Password creation is supported only in secure clusters for non- root users. The root user must authenticate with a client certificate and key. |
User authentication
Secure clusters require users to authenticate their access to databases and tables. CockroachDB offers two methods for this:
Client certificate and key authentication, which is available to all users. To ensure the highest level of security, we recommend only using client certificate and key authentication.
Password authentication, which is available to non-
rootusers who you've created passwords for. To create a user with a password, use theWITH PASSWORDclause ofCREATE USER. To add a password to an existing user, use theALTER USERstatement.Users can use passwords to authenticate without supplying client certificates and keys; however, we recommend using certificate-based authentication whenever possible.
Password creation is supported only in secure clusters.
Examples
Create a user
Usernames are case-insensitive; must start with a letter, number, or underscore; must contain only letters, numbers, or underscores; and must be between 1 and 63 characters.
> CREATE USER jpointsman;
After creating users, you must:
- Grant them privileges to databases.
- For secure clusters, you must also create their client certificates.
Create a user with a password
> CREATE USER jpointsman WITH PASSWORD 'Q7gc8rEdS';
Password creation is supported only in secure clusters for non-root users. The root user must authenticate with a client certificate and key.
Manage users
After creating a user, you can use the ALTER USER statement to add or change the user's password and the DROP USER statement to the remove users.
Authenticate as a specific user
Secure clusters with client certificates
All users can authenticate their access to a secure cluster using a client certificate issued to their username.
$ cockroach sql --user=jpointsman
Secure clusters with passwords
Users with passwords can authenticate their access by entering their password at the command prompt instead of using their client certificate and key.
If we cannot find client certificate and key files matching the user, we fall back on password authentication.
$ cockroach sql --user=jpointsman
$ cockroach sql --insecure --user=jpointsman
See also
- Authorization
ALTER USERDROP USERSHOW USERSGRANTSHOW GRANTS- Create Security Certificates
- Other SQL Statements
Was this helpful?
