This is archived documentation for InfluxData product versions that are no longer maintained. For newer documentation, see the latest InfluxData documentation.
This document covers setting up and managing authentication and authorization in InfluxDB.
- Set up authentication
- Authenticating requests
◦ Authenticate using the HTTP API
◦ Authenticate using the CLI
- User types and their privileges
◦ Admin users
◦ Non-admin users - User management commands
◦ Admin user management
□CREATE
a new admin user
□GRANT
administrative privileges to an existing user
□REVOKE
administrative privileges from an admin user
□SHOW
all existing users and their admin status
◦ Non-admin user management
□CREATE
a new non-admin user
□GRANT
READ
,WRITE
, orALL
database privileges to an existing user
□REVOKE
READ
,WRITE
, orALL
database privileges from an existing user
□SHOW
a user’s database privileges
◦ General admin and non-admin user management
□ ReSET
a user’s password
□DROP
a user
Authentication and authorization HTTP errors
Note: Authentication and authorization should not be relied upon to prevent access and protect data from malicious actors. If additional security or compliance features are desired, InfluxDB should be run behind a third party service.
Authentication
InfluxDB’s HTTP API and the command line interface (CLI), which connects to the database using the API, include simple, built-in authentication based on user credentials. When you enable authentication InfluxDB only executes HTTP requests that are sent with valid credentials.
Note: Authentication only occurs at the HTTP request scope. Plugins do not currently have the ability to authenticate requests and service endpoints (for example, Graphite, collectd, etc.) are not authenticated.
Set up authentication
Create at least one admin user. See the authorization section for how to create an admin user.
Note: If you enable authentication and have no users, InfluxDB will not enforce authentication and will only accept the query that creates a new admin user. InfluxDB will enforce authentication once there is an admin user.
By default, authentication is disabled in the configuration file. Enable authentication by setting the
auth-enabled
option totrue
in the[http]
section of the configuration file:[http] enabled = true bind-address = ":8086" auth-enabled = true # ✨ log-enabled = true write-tracing = false pprof-enabled = false https-enabled = false https-certificate = "/etc/ssl/influxdb.pem"
Restart the process.
Now InfluxDB will check user credentials on every request and will only process requests that have valid credentials for an existing user.
Authenticating requests
Authenticate using the HTTP API
There are two options for authenticating with the HTTP API.
- Authenticate with Basic Authentication as described in RFC 2617, Section 2 - this is the preferred method for providing user credentials.
Example:
curl -G http://localhost:8086/query -u todd:influxdb4ever --data-urlencode "q=SHOW DATABASES"
- Authenticate by providing query parameters in the URL.
Set
u
as the username andp
as the password.
Example:
curl -G http://localhost:8086/query --data-urlencode "u=todd" --data-urlencode "p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"
The queries in both examples assume that the user is an admin user. See the section on authorization for the different user types, their privileges, and more on user management.
If you authenticate with both Basic Authentication and the URL query parameters, the user credentials specified in the query parameters take precedence.
Note: InfluxDB redacts passwords when you enable authentication.
Authenticate using the CLI
There are two options for authenticating with the CLI.
Authenticate with
auth <username> <password>
after starting the CLI.Example:
$ influx Connected to http://localhost:8086 version 0.13.x InfluxDB shell 0.13.x > auth todd influxdb4ever >
Authenticate by setting the
username
andpassword
flags when you start the CLI.Example:
influx -username todd -password influxdb4ever
Authorization
Authorization is only enforced once you’ve enabled authentication. By default, authentication is disabled, all credentials are silently ignored, and all users have all privileges.
User types and their privileges
Admin users
Admin users have READ
and WRITE
access to all databases and full access to the following administrative queries:
Database management:
◦ CREATE DATABASE
, and DROP DATABASE
◦ DROP SERIES
and DROP MEASUREMENT
◦ CREATE RETENTION POLICY
, ALTER RETENTION POLICY
, and DROP RETENTION POLICY
◦ CREATE CONTINUOUS QUERY
and DROP CONTINUOUS QUERY
See the database management and continuous queries pages for a complete discussion of the commands listed above.
User management:
◦ Admin user management:
CREATE USER
, GRANT ALL PRIVILEGES
, REVOKE ALL PRIVILEGES
, and SHOW USERS
◦ Non-admin user management:
CREATE USER
, GRANT [READ,WRITE,ALL]
, REVOKE [READ,WRITE,ALL]
, and SHOW GRANTS
◦ General user management:
SET PASSWORD
and DROP USER
See below for a complete discussion of the user management commands.
Non-admin users
Non-admin users can have one of the following three privileges per database:
◦ READ
◦ WRITE
◦ ALL
(both READ
and WRITE
access)
READ
, WRITE
, and ALL
privileges are controlled per user per database.
A new non-admin user has no access to any database until they are specifically granted privileges to a database by an admin user.
User management commands
Admin user management
CREATE
a new admin user:CREATE USER <username> WITH PASSWORD '<password>' WITH ALL PRIVILEGES
CLI example:
> CREATE USER paul WITH PASSWORD 'timeseries4days' WITH ALL PRIVILEGES >
GRANT
administrative privileges to an existing user:GRANT ALL PRIVILEGES TO <username>
CLI example:
> GRANT ALL PRIVILEGES TO todd >
REVOKE
administrative privileges from an admin user:REVOKE ALL PRIVILEGES FROM <username>
CLI example:
> REVOKE ALL PRIVILEGES FROM todd >
SHOW
all existing users and their admin status:SHOW USERS
CLI example:
> SHOW USERS user admin todd false paul true hermione false dobby false
Non-admin user management
CREATE
a new non-admin user:CREATE USER <username> WITH PASSWORD '<password>'
CLI example:
> CREATE USER todd WITH PASSWORD 'influxdb41yf3' >
Note: The password string must be wrapped in single quotes. Do not include the single quotes when authenticating requests. For passwords that include a single quote or a newline character, escape the single quote or newline character with a backslash both when creating the password and when submitting authentication requests.
GRANT
READ
,WRITE
orALL
database privileges to an existing user:GRANT [READ,WRITE,ALL] ON <database_name> TO <username>
CLI examples:
GRANT
READ
access totodd
on theNOAA_water_database
database:> GRANT READ ON NOAA_water_database TO todd >
GRANT
ALL
access totodd
on theNOAA_water_database
database:> GRANT ALL ON NOAA_water_database TO todd >
REVOKE
READ
,WRITE
, orALL
database privileges from an existing user:REVOKE [READ,WRITE,ALL] ON <database_name> FROM <username>
CLI examples:
REVOKE
ALL
privileges fromtodd
on theNOAA_water_database
database:> REVOKE ALL ON NOAA_water_database FROM todd >
REVOKE
WRITE
privileges fromtodd
on theNOAA_water_database
database:> REVOKE WRITE ON NOAA_water_database FROM todd >
Note: If a user with
ALL
privileges hasWRITE
privileges revoked, they are left withREAD
privileges, and vice versa.SHOW
a user’s database privileges:SHOW GRANTS FOR <user_name>
CLI example:
> SHOW GRANTS FOR todd database privilege NOAA_water_database WRITE another_database_name READ yet_another_database_name ALL PRIVILEGES
General admin and non-admin user management
Re
SET
a user’s password:SET PASSWORD FOR <username> = '<password>'
CLI example:
> SET PASSWORD FOR todd = 'influxdb4ever' >
Note: The password string must be wrapped in single quotes. Do not include the single quotes when authenticating requests. For passwords that include a single quote or a newline character, escape the single quote or newline character with a backslash both when creating the password and when submitting authentication requests.
DROP
a user:DROP USER <username>
CLI example:
> DROP USER todd >
Authentication and authorization HTTP errors
Requests with invalid credentials and requests by unauthorized users yield the HTTP 401 Unauthorized
response.