CREATE ROLE

Creates a cluster-wide database role used for access control to database resources, such as keyspaces, tables, functions. Use roles to:

Create login accounts for CQL users.
Define a set of permissions that can be assigned to other roles and mapped to external users.

The best practices for using internal authentication are to create separate roles for various access permissions and login accounts. See GRANT PERMISSION and for more information on assigning permissions to roles, and GRANT ROLE for information on assigning roles to other roles.

When you install DSE, it creates a cassandra superuser role in the database, and DSE runs as this user. Don’t use the default cassandra role in production because it is a security risk. Instead, create a new superuser role for running DSE.

Syntax

CREATE ROLE [ IF NOT EXISTS ] <role_name>
  ( WITH PASSWORD = '<role_password>' )
  [ ( WITH | AND ) [ SUPERUSER = ( true | false ) ]
  [ ( WITH | AND ) LOGIN = ( true | false ) ]
  [ [ WITH | AND ] OPTIONS = { <custom_options_map> } ] ] ;

Legend
Syntax conventions	Description
UPPERCASE	Literal keyword.
Lowercase	Not literal.
`< >`	Variable value. Replace with a user-defined value.
`[]`	Optional. Square brackets (`[]`) surround optional command arguments. Do not type the square brackets.
`( )`	Group. Parentheses ( `( )` ) identify a group to choose from. Do not type the parentheses.
`\|`	Or. A vertical bar (`\|`) separates alternative elements. Type any one of the elements. Do not type the vertical bar.
`...`	Repeatable. An ellipsis ( `...` ) indicates that you can repeat the syntax element as often as required.
`'<Literal string>'`	Single quotation (`'`) marks must surround literal strings in CQL statements. Use single quotation marks to preserve upper case.
`{ <key> : <value> }`	Map collection. Braces (`{ }`) enclose map collections or key value pairs. A colon separates the key and the value.
`<<datatype1>,<datatype2>>`	Set, list, map, or tuple. Angle brackets ( `< >` ) enclose data types in a set, list, map, or tuple. Separate the data types with a comma.
`<cql_statement>;`	End CQL statement. A semicolon (`;`) terminates all CQL statements.
`[--]`	Separate the command line options from the command arguments with two hyphens ( `--` ). This syntax is useful when arguments might be mistaken for command line options.
`' <<schema\> ... </schema\>> '`	Search CQL only: Single quotation marks (`'`) surround an entire XML schema declaration.
`@<xml_entity>='<xml_entity_type>'`	Search CQL only: Identify the entity and literal value to overwrite the XML element in the schema and solrConfig files.

Options

Options Description Default

role_name

Name that uniquely identifies the role. CQL forces all names to lowercase. If you need to preserve case or use special characters in the role name, enclose the role name in quotes.

To automatically map external users to roles with DSE Unified Authenticator, the role name must exactly match the LDAP group name. LDAP mapping is case sensitive. For example, if your LDAP group name is Admins, the corresponding role name must also be Admins.

IF NOT EXISTS

Optional flag to create the role only if a role with the same name doesn’t already exist. If the role already exists, the command exits silently (no error is thrown) and the existing role remains unchanged.

WITH PASSWORD

Password for the role. Enclose the password in single quotes.

SUPERUSER

Optional. Full read/write access to the database. Only create roles with SUPERUSER that require full access to the keyspaces and tables. Use true to create a superuser role.

false

LOGIN

Optional. Allows the role to log in. Only create roles with LOGIN that require login access. Use true to create login accounts.

false

OPTIONS = { <option_map> }

Optional. Map of custom options. Reserved for use with authentication plug-ins. Refer to the authenticator documentation for details.

Examples

The following examples illustrate various CREATE ROLE operations.

Create a role

Create a role named cycling_admin:

CREATE ROLE IF NOT EXISTS cycling_admin
  WITH PASSWORD = 'All4One2day!';

By default, a role has no permissions, cannot log in, and doesn’t have superuser status.

Permissions must be granted after creating a role. See GRANT PERMISSION and GRANT ROLE.

Create a login account

Create a role named coach that has login privileges:

CREATE ROLE IF NOT EXISTS coach
WITH LOGIN = true
  AND PASSWORD = 'All4One2day!';

Verify that a role can log in

Use the LOGIN command to login as the specified role:

LOGIN coach;

When prompted, enter the password.

Once authenticated, the cqlsh prompt includes the role name:

coach@cqlsh>

Create a superuser role

Create a role WITH SUPERUSER to grant full access to all keyspaces and tables.

The following example creates a superuser role that also has login privileges and a password. LOGIN and PASSWORD aren’t required for WITH SUPERUSER, but they are recommended to avoid unauthorized access.

CREATE ROLE IF NOT EXISTS sys_admin
WITH SUPERUSER = true
  AND PASSWORD = 'changeme'
  AND LOGIN = true;

If you use the Unified Authenticator for external authentication, such as with LDAP, DataStax recommends that you enable internal authentication as an alternate method in your authentication configuration, and that you create at least one login-enabled superuser role with an internal password (the PASSWORD option). This configuration and role serve as a backup if authentication is misconfigured or the external authentication mechanism is unavailable; you can still access your database with the internally authenticated superuser role.

CREATE ROLE

Syntax

Options

Examples

Was this helpful?

Give Feedback