Managing Users¶

The CREATE USER statement (see Syntax of the CREATE USER statement) allows creating a new user in the Server. There are two types of users:

1. “Administrator” users (created by adding the ADMIN parameter to this statement). These users can perform any action over any database. You cannot restrict the privileges of an administrator user.

   Only administrator users can create administrator users.

2. “Normal” users. After creating them you have to grant them privileges so they can perform operations over the elements of the Server databases.

There are two authentication methods for Virtual DataPort users:

1. “Normal”: the credentials of the user are stored in Virtual DataPort.

2. “LDAP” (indicated with the LDAP parameter): when the user tries to connect to the Server, the Server connects to an LDAP server to check that the password provided by the user is correct.

   To use this authentication method, you have to create an LDAP data source that will be used to connect to the LDAP server, in order to check that the passwords provided by users are correct.

   The parameter LDAP has two parameters:

   1. DATASOURCE. The syntax is <databaseName>.<dataSourceName>. <databaseName> is the Virtual DataPort database where the LDAP data source is stored and <dataSourceName> is the name of the data source.

   2. USERNAME. It is the name of the user in the LDAP server. For example, the value 'cn=test,ou=People,dc=denodo,dc=com' identifies the test user in an organizational unit People for the domain denodo.com.

   Syntax of the CREATE USER statement¶

   CREATE [ OR REPLACE ] USER [ ADMIN ] <name:identifier>
       <authentication>
       [ <description:literal> ]
       [ <grant> ]*
   
   <authentication> ::=
         <password:literal> SHA512
       | LDAP (
             DATASOURCE <databaseName:identifier>.<dataSourceName:identifier>
             USERNAME <name:literal>
         )
   

<grant> ::= (see Syntax of the clauses GRANT/REVOKE of CREATE USER and ALTER USER)

The section Modifying the Privileges of a User explains how to modify the privileges of existing users.

SHA512 indicates that the password will be stored as a SHA512 hash.

Example

Creating a user with some privileges over the database “customer”:

-- Encrypt the password that you want the new user to have
ENCRYPT_PASSWORD 'new password of the user';

-- Create the user
CREATE OR REPLACE USER new_user '<result of the command ENCRYPT_PASSWORD>' ENCRYPTED TRANSFER
GRANT CONNECT, METADATA, EXECUTE, WRITE ON customer;