Manage Database Users
On this page
While a SingleStore Cloud user can log into the Cloud Portal and run SQL commands via the SQL Editor, the same SingleStore Cloud username cannot be used to log into a database from a third-party SQL client or development tool.
To log into a SingleStore Cloud database from a third-party SQL client or development tool, you must first add a database user.
As a workspace's
admin user is not always a log-in option for all organization members, SingleStore recommends adding a separate database user for each organization member.
If you have invited another SingleStore Cloud user to join your organization, please refrain from adding a database user with the same SingleStore Cloud username until after the invitation has been accepted.
Alternatively, you may create a database user with a different username than the SingleStore Cloud username, though this may make user management more challenging as additional organization members are added.
Use the GRANT command to add a database user.
GRANT <grant_options> TO '<user>'@'<host>' IDENTIFIED BY '<password>'
GRANT SELECT, INSERT ON db.* TO 'username'@'%' IDENTIFIED BY 'password'
Refer to GRANT for more information.
admin password is configured when the workspace is first created.
admin by default.
To change this password, navigate to the workspace name in the left nav > Workspace Overview > User Access.
Note: You must have
SUPER privileges to change another user’s password using the GRANT command.
SET PASSWORD command to change a database user's password.
SET PASSWORD FOR 'username'@'host' = PASSWORD('password');
To remove a database user, use the DROP USER command.
DROP USER '<user>'@'<host>'
You can view grants and permissions by querying
You can also view grants for a user by running SHOW GRANTS:
SHOW GRANTS FOR user@domain;
You can specify the number of times a user can enter an incorrect password before they are locked out of the system.
This feature can be enabled per user or per role, in which case every user belonging to that role will be subject to failed login attempt lockout.
To enable the lockout policy:
PASSWORD_ for the user or role.
FAILED_ is the number of failed attempts before the account is locked, for example:
PASSWORD_ is the number of seconds a locked out account must wait before reattempting to log in.
You must set both
PASSWORD_ to enable the feature.
Enable the lockout feature at 4 failed attempts, with a lockout time of 4 hours (14400 seconds) when creating a user:
CREATE USER user1 WITH FAILED_LOGIN_ATTEMPTS = 4 PASSWORD_LOCK_TIME = 14400;
Enabling the feature for a role:
CREATE ROLE general WITH FAILED_LOGIN_ATTEMPTS = 4 PASSWORD_LOCK_TIME = 14400;
If a user is associated with more than one role with different password lock times, the larger
PASSWORD_ value is applied.
If a user and a role the user is tied to have conflicting
FAILED_ settings, the lower value is applied.
PASSWORD_ value is updated for a role or user, the new setting applies to currently locked accounts.
PASSWORD_ is then set to 4 hours, the new limit is enforced and the account will be unlocked 4 hours after it was locked.
FAILED_ setting for a locked out user is updated to be higher than the current setting, the user is unlocked.
To unlock a locked account:
ALTER USER command and specify
ALTER USER user ACCOUNT UNLOCK;
Last modified: July 5, 2023