Help Center/ GaussDB/ Developer Guide(Distributed_V2.0-2.x)/ Database Security Management/ Users and Permissions/ Users
Updated on 2025-02-27 GMT+08:00
View PDF
Share

Users

You can use CREATE USER and ALTER USER to create and manage database users, respectively. A database cluster can have one or more databases. Users and roles are shared within the entire cluster, but their data is not shared. That is, a user can connect to any database, but after the connection is successful, any user can access only the database declared in the connection request.

In non-separation-of-duties scenarios, GaussDB user accounts can be created and deleted only by a system administrator or a security administrator with the CREATEROLE attribute. In separation-of-duties scenarios, a user account can be created only by an initial user or a security administrator.

When a user logs in, GaussDB authenticates the user. A user can own databases and database objects (such as tables), and grant permissions on these objects to other users and roles. In addition to system administrators, users with the CREATEDB attribute can create databases and grant permissions on these databases.

Adding, Modifying, and Deleting Users

  • To create a user, use the SQL statement CREATE USER.
    For example, create a user joe and set the CREATEDB attribute for the user. 
    1
2
    		 
    openGauss=# CREATE USER joe WITH CREATEDB PASSWORD "********";
CREATE ROLE
  • To create a system administrator, use the CREATE USER statement with the SYSADMIN parameter.
  • To delete an existing user, use DROP USER.
  • To change a user account (for example, rename the user or change the password), use ALTER USER.
  • To view a user list, query the PG_USER view. 
    1
    		 
    openGauss=# SELECT * FROM pg_user;
  • To view user attributes, query the system catalog PG_AUTHID. 
    1
    		 
    openGauss=# SELECT * FROM pg_authid;

Permanent User

GaussDB provides the permanent user solution. That is, create a permanent user with the PERSISTENCE attribute.

1
 
openGauss=# CREATE USER user_persistence WITH PERSISTENCE IDENTIFIED BY "********";

Only the initial user is allowed to create, modify, and delete permanent users with the PERSISTENCE attribute.

Parent topic: Users and Permissions