Skip to content
immudb docker run -d --net host -it --name immudb codenotary/immudb:latest

User Management

Creating users and assigning permissions#

User management is exposed with following methods:

  • CreateUser
  • ChangePermission
  • ChangePassword

Password must have between 8 and 32 letters, digits and special characters of which at least 1 uppercase letter, 1 digit and 1 special character.

Admin permissions are:

  • PermissionSysAdmin = 255
  • PermissionAdmin = 254

Non-admin permissions are:

  • PermissionNone = 0
  • PermissionR = 1
  • PermissionRW = 2

Go

 1package main
 2
 3import (
 4	"context"
 5	"log"
 6
 7	"github.com/codenotary/immudb/pkg/api/schema"
 8	"github.com/codenotary/immudb/pkg/auth"
 9	immudb "github.com/codenotary/immudb/pkg/client"
10)
11
12func main() {
13	opts := immudb.DefaultOptions().
14		WithAddress("localhost").
15		WithPort(3322)
16
17	client := immudb.NewClient().WithOptions(opts)
18	err := client.OpenSession(
19		context.TODO(),
20		[]byte(`immudb`),
21		[]byte(`immudb`),
22		"defaultdb",
23	)
24	if err != nil {
25		log.Fatal(err)
26	}
27
28	defer client.CloseSession(context.TODO())
29
30	err = client.CreateUser(
31		context.TODO(),
32		[]byte(`myNewUser1`),
33		[]byte(`myS3cretPassword!`),
34		auth.PermissionR,
35		"defaultdb",
36	)
37	if err != nil {
38		log.Fatal(err)
39	}
40
41	err = client.ChangePermission(
42		context.TODO(),
43		schema.PermissionAction_GRANT,
44		"myNewUser1",
45		"defaultDB",
46		auth.PermissionRW,
47	)
48	if err != nil {
49		log.Fatal(err)
50	}
51
52	err = client.ChangePassword(
53		context.TODO(),
54		[]byte(`myNewUser1`),
55		[]byte(`myS3cretPassword!`),
56		[]byte(`myNewS3cretPassword!`),
57	)
58	if err != nil {
59		log.Fatal(err)
60	}
61}

Java

 1package io.codenotary.immudb.helloworld;
 2
 3import io.codenotary.immudb4j.*;
 4
 5public class App {
 6
 7    public static void main(String[] args) {
 8        FileImmuStateHolder stateHolder = FileImmuStateHolder.newBuilder()
 9                    .withStatesFolder("./immudb_states")
10                    .build();
11
12        ImmuClient client = ImmuClient.newBuilder()
13                    .withServerUrl("127.0.0.1")
14                    .withServerPort(3322)
15                    .withStateHolder(stateHolder)
16                    .build();
17
18        client.login("immudb", "immudb");
19        
20        String database = "defaultdb";
21        String username = "testCreateUser";
22        String password = "testTest123!";
23        Permission permission = Permission.PERMISSION_RW;
24
25        client.createUser(username, password, permission, database);
26        
27        System.out.println("listUsers:");
28        List<User> users = client.listUsers();
29        users.forEach(user -> System.out.println("\t- " + user));
30
31        // Changing the user password.
32        client.changePassword(username, password, "newTestTest123!");
33    }
34
35}

Python

 1from grpc import RpcError
 2from immudb import ImmudbClient
 3from immudb.constants import PERMISSION_ADMIN, PERMISSION_R, PERMISSION_RW
 4from immudb.grpc.schema_pb2 import GRANT, REVOKE
 5from enum import IntEnum
 6
 7URL = "localhost:3322"  # immudb running on your machine
 8LOGIN = "immudb"        # Default username
 9PASSWORD = "immudb"     # Default password
10DB = b"defaultdb"       # Default database name (must be in bytes)
11
12def main():
13    client = ImmudbClient(URL)
14    client.login(LOGIN, PASSWORD, database = DB)
15    passwordForNewUsers = "Te1st!@#Test"
16    try:
17        client.createUser("tester1", passwordForNewUsers, PERMISSION_R, DB)
18        client.createUser("tester2", passwordForNewUsers, PERMISSION_RW, DB)
19        client.createUser("tester3", passwordForNewUsers, PERMISSION_ADMIN, DB)
20    except RpcError as exception:
21        print(exception.details())
22
23    users = client.listUsers().userlist.users # immudb.handler.listUsers.listUsersResponse
24    for user in users:
25        print("User", user.user)
26        print("Created by", user.createdby)
27        print("Creation date", user.createdat)
28        print("Is active", user.active)
29        for permission in user.permissions:
30            print("Permission", permission.database, permission.permission)
31        print("---")
32
33    client.login("tester3", passwordForNewUsers, DB)
34    client.changePermission(GRANT, "tester2", DB, PERMISSION_ADMIN)
35    client.changePermission(REVOKE, "tester2", DB, PERMISSION_ADMIN)
36
37    client.login(LOGIN, PASSWORD, database = DB)
38    # Changing password
39    client.changePassword("tester1", "N1ewpassword!", passwordForNewUsers)
40
41    # User logs with new password
42    client.login("tester1", "N1ewpassword!")
43
44    client.login(LOGIN, PASSWORD, database = DB)
45    client.changePassword("tester1", passwordForNewUsers, "N1ewpassword!")
46    
47
48    client.login("tester1", passwordForNewUsers, DB)
49
50    # No permissions to write
51    try:
52        client.set(b"test", b"test")
53    except RpcError as exception:
54        print(exception.details())
55
56    # But has permissions to read
57    result = client.get(b"test")
58
59    client.login("tester3", passwordForNewUsers, DB)
60
61    # Now will have permissions to write
62    client.changePermission(GRANT, "tester1", DB, PERMISSION_RW)
63    client.login("tester1", passwordForNewUsers, DB)
64    client.set(b"test", b"test")
65    result = client.get(b"test")
66
67    client.login("tester3", passwordForNewUsers, DB)
68
69    # Now will have permissions to nothing
70    client.changePermission(REVOKE, "tester1", DB, PERMISSION_RW)
71
72    try:
73        client.login("tester1", passwordForNewUsers, DB)
74    except RpcError as exception:
75        print(exception.details())
76    
77    client.login("tester3", passwordForNewUsers, DB)
78    client.changePermission(GRANT, "tester1", DB, PERMISSION_RW)
79
80if __name__ == "__main__":
81    main()

Node.js

 1import ImmudbClient from 'immudb-node'
 2import Parameters from 'immudb-node/types/parameters'
 3import { USER_ACTION, USER_PERMISSION } from 'immudb-node/dist/types/user'
 4
 5const IMMUDB_HOST = '127.0.0.1'
 6const IMMUDB_PORT = '3322'
 7const IMMUDB_USER = 'immudb'
 8const IMMUDB_PWD = 'immudb'
 9
10const cl = new ImmudbClient({ host: IMMUDB_HOST, port: IMMUDB_PORT });
11
12(async () => {
13	await cl.login({ user: IMMUDB_USER, password: IMMUDB_PWD })
14
15	const createUserRequest: Parameters.CreateUser = {
16		user: 'myNewUser1',
17		password: 'myS3cretPassword!',
18		permission: USER_PERMISSION.READ_ONLY,
19		database: 'defaultdb',
20	};
21	const createUserRes = cl.createUser(createUserRequest)
22	console.log('success: createUser', createUserRes)
23
24	const changePermissionReq: Parameters.ChangePermission = {
25		action: USER_ACTION.GRANT,
26		username: 'myNewUser1',
27		database: 'defaultDB',
28		permission: USER_PERMISSION.READ_WRITE
29	}
30	const changePermissionRes = await cl.changePermission(changePermissionReq)
31	console.log('success: changePermission', changePermissionRes)
32
33	const changePasswordReq: Parameters.ChangePassword = {
34		user: 'myNewUser1',
35		oldpassword: 'myS3cretPassword!',
36		newpassword: 'myNewS3cretPassword!'
37	}
38	const changePasswordRes = await cl.changePassword(changePasswordReq)
39	console.log('success: changePassword', changePermissionRes)
40})()

.NET

 1
 2var client = new ImmuClient();
 3await client.Open("immudb", "immudb", "defaultdb");
 4
 5try
 6{
 7    await client.CreateUser("testUser", "testTest123!", Permission.PERMISSION_ADMIN, "defaultdb");
 8}
 9catch (Exception e)
10{
11    Console.WriteLine($"An exception in create user: {e}");
12    return;
13}
14
15await client.ChangePassword("testUser", "testTest123!", "newTestTest123!");
16await client.Close();

Others

If you’re using another development language, please refer to the immugw option.


Changing user’s password#

Changing user’s password can be done by either the sysadmin user (which can be done for any user in the database) or by user with Admin permission to at least one database that has created the user whose password is changed:

1$ immuadmin user changepassword user
2Choose a password for user:
3Confirm password:
4user's password has been changed

The sysadmin user can change his own password the same way but it requires confirming the existing password:

1$ immuadmin user changepassword immudb
2Old password:
3Choose a password for immudb:
4Confirm password:
5immudb's password has been changed

Emergency reset of sysadmin user password#

If the current password of the sysadmin user is not known, it can be reset by running the immudb server with password reset option:

1immudb --force-admin-password --admin-password <new-password>

The --force-admin-password flag ensures that the sysadmin user will have its password reset to the one given through the --admin-password option.

Edit this page on GitHub Last updated