# Manage Database Users ## Add a Database User Database users are created automatically for all SingleStore Helios users who are granted access to a workspace group. These users can access workspaces in the Portal or the SQL Editor and can also be used for third-party SQL clients or development tools. Refer [Authenticate via Browser-based SSO using JWTs](https://docs.singlestore.com/cloud/security/database-access/authenticate-via-browser-based-sso-using-jwts.md) for more information about authentication from third-party clients. Database users can also be added by using the [`CREATE USER`](https://docs.singlestore.com/cloud/reference/sql-reference/security-management-commands/create-user.md) command. The [`GRANT`](https://docs.singlestore.com/cloud/reference/sql-reference/security-management-commands/grant.md) command cannot be used to add a new user since auto user creation by using the `GRANT` command is deprecated and the `NO_AUTO_CREATE_USER` variable is enabled by default. If you have invited another SingleStore Helios user to join your [organization](https://docs.singlestore.com/cloud/user-and-workspace-administration/manage-organizations.md), refrain from adding a database user with the same SingleStore Helios email address (i. e. the username) until after the invitation has been accepted. As the admin user is not always a workspace log-in option for all organization members, SingleStore recommends adding a separate database user for each organization member. ## Change a Database User Password The database `admin` password is configured when the workspace is first created. This is also referred to as the “Master Username” in the Cloud Portal, which is `admin` by default. To change this password, navigate to **Workspaces** in the left navigation pane, and then select **Connect > CLI Client** for the workspace. Under **User Credentials**, select **Reset Password** next to the **Password** field and follow the provided instructions. Use the `SET PASSWORD` command to change a database user's password. A database user can also use this command to change their own password. ```sql SET PASSWORD FOR 'username'@'host' = PASSWORD('password'); ``` ## Remove a Database User To remove a database user, use the [DROP USER](https://docs.singlestore.com/cloud/reference/sql-reference/security-management-commands/drop-user.md) command. ```sql DROP USER ''@'' ``` ## Inspect Database User Permissions You can view grants and permissions by querying `information_schema.user_privileges`. You can also view grants for a user by running [SHOW GRANTS](https://docs.singlestore.com/cloud/reference/sql-reference/security-management-commands/show-grants.md): ```sql SHOW GRANTS FOR user@domain; ``` ## Set a Login Attempt Lockout Policy for a Database User You can specify the number of times a user can enter an incorrect password before they are locked out of the system. When a user reaches this limit, their account is locked for the specified number of seconds. This feature can be enabled per user or per role, in which case every user belonging to that role will be subject to failed login attempt lockout. ## Enable the Lockout Policy To enable the lockout policy: Set *both*`FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME` for the user or role. `FAILED_LOGIN_ATTEMPTS` is the number of failed attempts before the account is locked, for example: `4`. `PASSWORD_LOCK_TIME` is the number of seconds a locked out account must wait before reattempting to log in. > **📝 Note**: You must set both `FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME` to enable the feature. Enable the lockout feature at 4 failed attempts, with a lockout time of 4 hours (14400 seconds) when creating a user: ```sql CREATE USER user1 WITH FAILED_LOGIN_ATTEMPTS = 4 PASSWORD_LOCK_TIME = 14400; ``` Enabling the feature for a role: ```sql CREATE ROLE general WITH FAILED_LOGIN_ATTEMPTS = 4 PASSWORD_LOCK_TIME = 14400; ``` If a user is associated with more than one role with different password lock times, the larger `PASSWORD_LOCK_TIME` value is applied. If a user and a role the user is tied to have conflicting `FAILED_LOGIN_ATTEMPTS` settings, the lower value is applied. ## Update Lockout Settings If the `PASSWORD_LOCK_TIME` value is updated for a role or user, the new setting applies to currently locked accounts. For example, if a locked out user’s lockout time setting is 1 day, and `PASSWORD_LOCK_TIME` is then set to 4 hours, the new limit is enforced and the account will be unlocked 4 hours after it was locked. If a user’s lockout time setting is 4 hours, and the setting is increased to 1 day, the user will remain locked out for 1 day. If the `FAILED_LOGIN_ATTEMPTS` setting for a locked out user is updated to be higher than the current setting, the user is unlocked. If the new setting is lower than the current number of failed login attempts, and also higher than the user’s current number of failed login attempts, the new setting is ignored until the user successfully logs in. The user is still subject to the original `FAILED_LOGIN_ATTEMPTS` setting. ## Unlock a Locked Account To unlock a locked account: Use the `ALTER USER` command and specify `ACCOUNT UNLOCK`. ```sql ALTER USER user ACCOUNT UNLOCK; ``` If an account is locked either manually using the `ALTER USER … ACCOUNT LOCK` command or automatically has a result of exceeding the values specified for `FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME` arguments, restarting the cluster removes the lock and returns the account’s status to ONLINE. The account lock needs to be explicitly re-applied after the cluster is back online and/or automated as part of the customer’s operational procedures. Users can confirm the lock state before and after a restart by viewing the `ACCOUNT_STATUS` column in the information\_schema.USERS view. *** Modified at: April 30, 2026 Source: [/cloud/user-and-workspace-administration/manage-database-users/](https://docs.singlestore.com/cloud/user-and-workspace-administration/manage-database-users/) (An index of the documentation is available at /llms.txt)