When creating users, it’s also important to note:
- After creating users, you must grant them privileges to databases and tables.
- On secure clusters, users must authenticate their access to the cluster.
cockroach usercommand. Notably, this is the most efficient way to remove users.
The user must have the
UPDATE privileges on the
||The name of the user you want to create.|
||Let the user authenticate their access to a secure cluster using this password. Passwords must be entered as string values surrounded by single quotes (
Secure clusters require users to authenticate their access to databases and tables. CockroachDB offers two methods for this:
- Client certificate and key authentication, which is available to all users. To ensure the highest level of security, we recommend only using client certificate and key authentication.
- Password authentication, which is available only to users who you’ve created passwords for. To create a user with a password, use the
WITH PASSWORDclause of
You can use this password to authenticate users without supplying their client certificate and key; however, we recommend instead using client certificate and key authentication whenever possible.
To add a password to an existing user, use the
root) through the
Create a User
> CREATE USER jpointsman;
After creating users, you must grant them privileges to databases and tables.
For users on secure clusters, you also need to generate client certificates and keys to authenticate the user’s access to the cluster.
Create a User with Password Authentication
> CREATE USER jpointsman WITH PASSWORD 'Q7gc8rEdS';
After creating users, you can manage them using the
cockroach user command.
Authenticate as a Specific User
$ cockroach sql --user=jpointsman
Secure Clusters with Client Certificates
All users can authenticate their access to a secure cluster using a client certificate issued to their username.
$ cockroach sql --user=jpointsman --ca-cert=certs/ca.cert --cert=jpointsman.cert --key=jpointsman.key
Secure Clusters with Passwords
Users with passwords can authenticate their access by entering their password at the command prompt instead of using their client certificate and key.
$ cockroach sql --user=jpointsman --ca-cert=certs/ca.cert
After issuing this command, you must enter the password for
- Create Security Certificates
- Other SQL Statements