Add database users

DataStax Enterprise (DSE) doesn’t have a dedicated object for users. Instead, users are represented by database roles.

You can create roles specifically to grant access to users or service accounts, or you can create roles to contain sets of permissions that are then granted to other roles. For example, an admin role might contain administrative permissions that are then granted to additional roles for specific users, such as amy and joe.

Roles have a name, at minimum. If authentication is enabled, you can also provide a login and password or hashed password. For database-managed authentication, use the internal scheme in the authentication_options in dse.yaml.

Create a role with login enabled and an internally stored password:
```
CREATE ROLE <role_name>
WITH LOGIN = true
AND PASSWORD = '<password_string>';
```
where
- <role_name>: The user name for authentication. Enclose the role names that include uppercase or special characters in double quotes.
- LOGIN = true: Allows the role to access the database.
- PASSWORD = '<default_password>': Stored as a salted hash for internally authenticated database roles.
- (Optional) superuser = true: Grants full access to all database objects. See Add a superuser role.
This command can also be modified to use a hashed password:
CREATE ROLE <role_name> WITH LOGIN = true AND HASHED PASSWORD = '<hashed_password_string>';
with the DSE tool hash_password -p <hashed_password_string>.
DSE uses the bcrypt library, Blowfish, and a log2 factor of 10 to generate a random salt added to the password hash.
To allow the role to be used for authentication when scheme_permissions is true, bind the role to an authentication scheme:
```
GRANT EXECUTE
ON INTERNAL SCHEME
TO <role_name>;
```
To allow another role to manage the new role:
```
GRANT AUTHORIZE FOR ALTER, DROP
ON <new_role_name>
TO <management_role>;
```
All superusers have AUTHORIZE permissions on all roles. The role that created the role is also granted all permissions on that role.

Each user can change their own password with the ALTER ROLE command.

User logs in with their role name:

cqlsh -u <role_name> -p <default_password>

Changes the password:

ALTER ROLE <role_name>
WITH password = '<newpassword>';

or if using a hashed password:

ALTER ROLE <role_name>
WITH HASHED PASSWORD = '<Hashed_newpassword>';

Grant permissions to the role.

Add database users

Was this helpful?

Give Feedback