Add database users

In a Hyper-Converged Database (HCD) database, a user account is represented by a CQL ROLE that has the LOGIN and PASSWORD options.

Prerequisites

Enable the internal scheme in the authenticator.parameters section of the cassandra.yaml configuration file.

By default, authentication is disabled in HCD. You must enable it by setting enabled: true in the authenticator parameters before creating database users.

Create a role

Create a role with LOGIN enabled and a PASSWORD:
```
CREATE ROLE <role_name>
WITH LOGIN = true
AND PASSWORD = '<password_string>';
```
Include or replace the following:
- <role_name>: The user name for authentication. Enclose the role names that include uppercase or special characters in double quotes.
- LOGIN = true: Allows the role to access the database.
- PASSWORD = '<default_password>': Stored internally for database managed accounts. HCD uses the bcrypt library, Blowfish, and a log2 factor of 10 to generate a random salt added to the password hash.
- SUPERUSER = true (optional): Gives full access to all database objects to the user. See Add a superuser login.
To allow the role to be used for authentication when scheme permissions are enabled, bind the role to an authentication scheme:
```
GRANT EXECUTE
ON INTERNAL SCHEME
TO <role_name>;
```
Each user can change their own password with the ALTER ROLE command.
1. User logs in with their role name:
  cqlsh -u <role_name> -p <default_password>
2. Changes the password:
  ALTER ROLE <role_name> WITH password = '<newpassword>';

Next steps

Assign permissions to the role, see Assign permissions.

Add database users

Prerequisites

Create a role

Next steps

Was this helpful?

Give Feedback