Project: StarRocks (App Definition and Development / Database)
File: CREATE_USER.md

displayed_sidebar: "English" import UserManagementPriv from '../../../assets/commonMarkdown/userManagementPriv.md' Creates a StarRocks user. In StarRocks, a "user_identity" uniquely identifies a user. <UserManagementPriv /> ```SQL CREATE USER <useridentity> [authoption] [DEFAULT ROLE <rolename>[, <rolename>, ...]] ``` `useridentity` consists of two parts, "username" and "host", in the format of `username@'userhost'`. For the "host" part, you can use `%` for fuzzy match. If "host" is not specified, "%" is used by default, meaning that the user can connect to StarRocks from any host. For the naming conventions of usernames, see . `authoption` specifies the authentication method. Currently, three authentication methods are supported: StarRocks native password, mysqlnativepassword, and "authenticationldapsimple". StarRocks native password is the same as mysqlnative_password in logic but slightly differs in syntax. One user identity can use only one authentication method. ```SQL auth_option: { IDENTIFIED BY 'auth_string' IDENTIFIED WITH mysqlnativepassword BY 'auth_string' IDENTIFIED WITH mysqlnativepassword AS 'auth_string' IDENTIFIED WITH authenticationldapsimple AS 'auth_string' } ``` | Authentication method | Password for user creation | Password for login | | - | | - | | Native password | Plaintext or ciphertext | Plaintext | | `mysqlnativepassword BY` | Plaintext | Plaintext | | `mysqlnativepassword WITH` | Ciphertext | Plaintext | | `authenticationldapsimple` | Plaintext | Plaintext | Note: StarRocks encrypts users' passwords before storing them. `DEFAULT ROLE <rolename>[, <rolename>, ...]`: If this parameter is specified, the roles are automatically assigned to the user and activated by default when the user logs in. If not specified, this user does not have any privileges. Make sure that all the roles that are specified already exist. Example 1: Create a user using a plaintext password with no host specified, which is equivalent to `jack@'%'`. ```SQL CREATE USER 'jack' IDENTIFIED BY '123456'; ``` Example 2: Create a user using a plaintext password and allow the user to log in from `'172.10.1.10'`. ```SQL CREATE USER jack@'172.10.1.10' IDENTIFIED WITH mysqlnativepassword BY '123456'; ``` Example 3: Create a user with a ciphertext password and allow the user to log in from `'172.10.1.10'`. ```SQL CREATE USER jack@'172.10.1.10' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9'; CREATE USER jack@'172.10.1.10' IDENTIFIED WITH mysqlnativepassword AS '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9'; ``` Note: You can get the encrypted password using the password() function. Example 4: Create a user who is allowed to log in from a domain name 'example_domain'. ```SQL CREATE USER 'jack'@['example_domain'] IDENTIFIED BY '123456'; ``` Example 5: Create a user that uses LDAP authentication. ```SQL CREATE USER jack@'172.10.1.10' IDENTIFIED WITH authenticationldapsimple; ``` Example 6: Create a user that uses LDAP authentication and specify the distinguished name (DN) of the user in LDAP. ```SQL CREATE USER jack@'172.10.1.10' IDENTIFIED WITH authenticationldapsimple AS 'uid=jack,ou=company,dc=example,dc=com'; ``` Example 7: Create a user who is allowed to log in from the '192.168' subnet and set `dbadmin` and `useradmin` as the default roles for the user. ```SQL CREATE USER 'jack'@'192.168.%' DEFAULT ROLE dbadmin, useradmin; ```