Authentication and Authorization

This document covers setting up and managing authentication and authorization in InfluxDB.

Set up authentication
Authenticating requests
◦ Authenticate using the HTTP API
◦ Authenticate using the CLI

User types and their privileges
◦ Admin users
◦ Non-admin users
User management commands
   ◦      Admin user management
             □      CREATE a new admin user
             □      GRANT administrative privileges to an existing user
             □      REVOKE administrative privileges from an admin user
             □      SHOW all existing users and their admin status
   ◦      Non-admin user management
             □      CREATE a new non-admin user
             □      GRANT READ,WRITE, or ALL database privileges to an existing user
             □      REVOKE READ,WRITE, or ALL database privileges from an existing user
             □      SHOW a user’s database privileges
   ◦      General admin and non-admin user management
             □      ReSET a user’s password
             □      DROP a user

Authentication and authorization HTTP errors

Note: Authentication and authorization should not be relied upon to prevent access and protect data from malicious actors. If additional security or compliance features are desired, InfluxDB should be run behind a third party service.

Authentication

InfluxDB’s HTTP API and the command line interface (CLI), which connects to the database using the API, include simple, built-in authentication based on user credentials. When you enable authentication InfluxDB only executes HTTP requests that are sent with valid credentials.

Note: Authentication only occurs at the HTTP request scope. Plugins do not currently have the ability to authenticate requests and service endpoints (for example, Graphite, collectd, etc.) are not authenticated.

Set up authentication

Create at least one admin user. See the authorization section for how to create an admin user.
Note: If you enable authentication and have no users, InfluxDB will not enforce authentication and will only accept the query that creates a new admin user.
InfluxDB will enforce authentication once there is an admin user.

By default, authentication is disabled in the configuration file. Enable authentication by setting the auth-enabled option to true in the [http] section of the configuration file:

[http]  
enabled = true  
bind-address = ":8086"  
auth-enabled = true # ✨
log-enabled = true  
write-tracing = false  
pprof-enabled = false  
https-enabled = false  
https-certificate = "/etc/ssl/influxdb.pem"

Restart the process.

Now InfluxDB will check user credentials on every request and will only process requests that have valid credentials for an existing user.

Authenticating requests

Authenticate using the HTTP API

There are two options for authenticating with the HTTP API.

Authenticate with Basic Authentication as described in RFC 2617, Section 2 - this is the preferred method for providing user credentials.

Example:

curl -G http://localhost:8086/query -u todd:influxdb4ever --data-urlencode "q=SHOW DATABASES"

Authenticate by providing query parameters in the URL. Set u as the username and p as the password.

Example:

curl -G http://localhost:8086/query --data-urlencode "u=todd" --data-urlencode "p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"

The queries in both examples assume that the user is an admin user. See the section on authorization for the different user types, their privileges, and more on user management.

If you authenticate with both Basic Authentication and the URL query parameters, the user credentials specified in the query parameters take precedence.

Note: InfluxDB redacts passwords when you enable authentication.

Authenticate using the CLI

There are two options for authenticating with the CLI.

Authenticate with auth <username> <password> after starting the CLI.

Example:

$ influx
Connected to http://localhost:8086 version 1.0.x
InfluxDB shell 1.0.x
> auth todd influxdb4ever
>

Authenticate by setting the username and password flags when you start the CLI.
Example:
```
influx -username todd -password influxdb4ever
```

Authorization

Authorization is only enforced once you’ve enabled authentication. By default, authentication is disabled, all credentials are silently ignored, and all users have all privileges.

User types and their privileges

Admin users

Admin users have READ and WRITE access to all databases and full access to the following administrative queries:

Database management:
   ◦      CREATE DATABASE, and DROP DATABASE
   ◦      DROP SERIES and DROP MEASUREMENT
   ◦      CREATE RETENTION POLICY, ALTER RETENTION POLICY, and DROP RETENTION POLICY
   ◦      CREATE CONTINUOUS QUERY and DROP CONTINUOUS QUERY

See the database management and continuous queries pages for a complete discussion of the commands listed above.

User management:
   ◦      Admin user management:
           CREATE USER, GRANT ALL PRIVILEGES, REVOKE ALL PRIVILEGES, and SHOW USERS
   ◦      Non-admin user management:
           CREATE USER, GRANT [READ,WRITE,ALL], REVOKE [READ,WRITE,ALL], and SHOW GRANTS
   ◦      General user management:
           SET PASSWORD and DROP USER

See below for a complete discussion of the user management commands.

Non-admin users

Non-admin users can have one of the following three privileges per database:
   ◦      READ
   ◦      WRITE
   ◦      ALL (both READ and WRITE access)

READ, WRITE, and ALL privileges are controlled per user per database. A new non-admin user has no access to any database until they are specifically granted privileges to a database by an admin user.

User management commands

Admin user management

`CREATE` a new admin user:

CREATE USER <username> WITH PASSWORD '<password>' WITH ALL PRIVILEGES

CLI example:

> CREATE USER "paul" WITH PASSWORD 'timeseries4days' WITH ALL PRIVILEGES
>

`GRANT` administrative privileges to an existing user:

GRANT ALL PRIVILEGES TO <username>

CLI example:

> GRANT ALL PRIVILEGES TO "todd"
>

`REVOKE` administrative privileges from an admin user:

REVOKE ALL PRIVILEGES FROM <username>

CLI example:

> REVOKE ALL PRIVILEGES FROM "todd"
>

`SHOW` all existing users and their admin status:

SHOW USERS

CLI example:

> SHOW USERS
user     admin
todd     false
paul     true
hermione false
dobby    false

Non-admin user management

CREATE a new non-admin user:
```
CREATE USER <username> WITH PASSWORD '<password>'
```
CLI example:
```
> CREATE USER "todd" WITH PASSWORD 'influxdb41yf3'
>
```
Note: The password string must be wrapped in single quotes. Do not include the single quotes when authenticating requests. For passwords that include a single quote or a newline character, escape the single quote or newline character with a backslash both when creating the password and when submitting authentication requests.
GRANT READ, WRITE or ALL database privileges to an existing user:
```
GRANT [READ,WRITE,ALL] ON <database_name> TO <username>
```
CLI examples:
GRANT READ access to todd on the NOAA_water_database database:
```
> GRANT READ ON "NOAA_water_database" TO "todd"
>
```
GRANT ALL access to todd on the NOAA_water_database database:
```
> GRANT ALL ON "NOAA_water_database" TO "todd"
>
```
REVOKE READ, WRITE, or ALL database privileges from an existing user:
```
REVOKE [READ,WRITE,ALL] ON <database_name> FROM <username>
```
CLI examples:
REVOKE ALL privileges from todd on the NOAA_water_database database:
```
> REVOKE ALL ON "NOAA_water_database" FROM "todd"
>
```
REVOKE WRITE privileges from todd on the NOAA_water_database database:
```
> REVOKE WRITE ON "NOAA_water_database" FROM "todd"
>
```
Note: If a user with ALL privileges has WRITE privileges revoked, they are left with READ privileges, and vice versa.

`SHOW` a user’s database privileges:

SHOW GRANTS FOR <user_name>

CLI example:

> SHOW GRANTS FOR "todd"
database                    privilege
NOAA_water_database         WRITE
another_database_name       READ
yet_another_database_name   ALL PRIVILEGES

General admin and non-admin user management

ReSET a user’s password:
```
SET PASSWORD FOR <username> = '<password>'
```
CLI example:
```
> SET PASSWORD FOR "todd" = 'influxdb4ever'
>
```
Note: The password string must be wrapped in single quotes. Do not include the single quotes when authenticating requests. For passwords that include a single quote or a newline character, escape the single quote or newline character with a backslash both when creating the password and when submitting authentication requests.

`DROP` a user:

DROP USER <username>

CLI example:

> DROP USER "todd"
>