Authentication and authorization in InfluxDB

    The InfluxDB API and the command line interface (CLI), which connects to the database using the API, include simple, built-in authentication based on user credentials.When you enable authentication, InfluxDB only executes HTTP requests that are sent with valid credentials.

    Note: Authentication only occurs at the HTTP request scope.Plugins do not currently have the ability to authenticate requests and service endpoints (for example, Graphite, collectd, etc.) are not authenticated.

    1. Create at least one admin user.

    See the authorization section for how to create an admin user.

    InfluxDB will enforce authentication once there is an admin user.

    2. By default, authentication is disabled in the configuration file.

    Enable authentication by setting the option to true in the [http] section of the configuration file:

    If pprof-enabled is set to true, set pprof-auth-enabled and ping-auth-enabledto true to require authentication on profiling and ping endpoints.

    3. Restart the process

    Now InfluxDB will check user credentials on every request and will only process requests that have valid credentials for an existing user.

    Authenticate with the InfluxDB API

    There are two options for authenticating with the InfluxDB API.

    If you authenticate with both Basic Authentication and the URL query parameters, the user credentials specified in the query parameters take precedence.The queries in the following examples assume that the user is an .See the section on authorization for the different user types, their privileges, and more on user management.

    Note: InfluxDB redacts passwords when you enable authentication.

    Authenticate with Basic Authentication as described in RFC 2617, Section 2

    This is the preferred method for providing user credentials.

    Example:

    1. curl -G http://localhost:8086/query -u todd:influxdb4ever --data-urlencode "q=SHOW DATABASES"
    Authenticate by providing query parameters in the URL or request body

    Set u as the username and p as the password.

    Example using query parameters
    1. curl -G "http://localhost:8086/query?u=todd&p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"
    Example using request body
    1. curl -G http://localhost:8086/query --data-urlencode "u=todd" --data-urlencode "p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"

    Authenticate with the CLI

    There are three options for authenticating with the CLI.

    Authenticate with the INFLUX_USERNAME and INFLUX_PASSWORD environment variables

    Example:

    1. export INFLUX_USERNAME=todd
    2. export INFLUX_PASSWORD=influxdb4ever
    3. echo $INFLUX_USERNAME $INFLUX_PASSWORD
    4. todd influxdb4ever
    6. influx
    7. Connected to http://localhost:8086 version 1.4.x
    8. InfluxDB shell 1.4.x
    Authenticate by setting the username and password flags when you start the CLI

    Example:

    1. influx -username todd -password influxdb4ever
    2. Connected to http://localhost:8086 version 1.4.x
    3. InfluxDB shell 1.4.x
    Authenticate with auth <username> <password> after starting the CLI

    Example:

    1. influx
    2. Connected to http://localhost:8086 version 1.4.x
    3. InfluxDB shell 1.4.x
    4. > auth
    5. username: todd
    6. password:
    7. >

    Authenticate using JWT tokens

    Passing JWT tokens in each request is a more secure alternative to using passwords.This is currently only possible through the .

    1. Add a shared secret in your InfluxDB configuration file
    1. [http]
    2.   shared-secret = "my super secret pass phrase"

    Alternatively, to avoid keeping your secret phrase as plain text in your InfluxDB configuration file, set the value with the INFLUXDB_HTTP_SHARED_SECRET environment variable.

    2. Generate your token

    Use an authentication service to generate a secure token using your InfluxDB username, an expiration time, and your shared secret.There are online tools, such as https://jwt.io/, that will do this for you.

    The payload (or claims) of the token must be in the following format:

    1. {
    2.   "username": "myUserName",
    3.   "exp": 1516239022
    4. }

    ◦ username - The name of your InfluxDB user.◦ exp - The expiration time of the token in UNIX epoch time.For increased security, keep token expiration periods short.For testing, you can manually generate UNIX timestamps using .

    Encode the payload using your shared secret.You can do this with either a JWT library in your own authentication server or by hand at https://jwt.io/.The generated token should look similar to the following:

    1. eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.he0ErCNloe4J7Id0Ry2SEDg09lKkZkfsRiGsdX_vgEg
    3. Include the token in HTTP requests

    Include your generated token as part of the Authorization header in HTTP requests.Use the Bearer authorization scheme:

    1. Authorization: Bearer <myToken>

    Only unexpired tokens will successfully authenticate.Be sure your token has not expired.

    Example query request with JWT authentication
    1. curl -XGET "http://localhost:8086/query?db=demodb" \
    2.   --data-urlencode "q=SHOW DATABASES" \
    3.   --header "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.he0ErCNloe4J7Id0Ry2SEDg09lKkZkfsRiGsdX_vgEg"

    Authenticating requests to an InfluxDB instance withauthentication enabled requires some additional steps.In the Telegraf configuration file (/etc/telegraf/telegraf.conf), uncommentand edit the username and password settings.

    Next, restart Telegraf and you’re all set!

    Authorization is only enforced once you’ve enabled authentication.By default, authentication is disabled, all credentials are silently ignored, and all users have all privileges.

    Admin users

    Admin users have READ and access to all databases and full access to the following administrative queries:

    Database management: ◦ CREATE DATABASE, and DROP DATABASE ◦ DROP SERIES and DROP MEASUREMENT ◦ CREATE RETENTION POLICY, ALTER RETENTION POLICY, and DROP RETENTION POLICY ◦ CREATE CONTINUOUS QUERY and DROP CONTINUOUS QUERY

    See the database management and pages for a complete discussion of the commands listed above.

    User management: ◦ Admin user management: CREATE USER, , REVOKE ALL PRIVILEGES, and ◦ Non-admin user management: CREATE USER, , REVOKE [READ,WRITE,ALL], and ◦ General user management: SET PASSWORD and

    See below for a complete discussion of the user management commands.

    Non-admin users

    Non-admin users can have one of the following three privileges per database: ◦ READ ◦ WRITE ◦ ALL (both READ and WRITE access)

    READ, WRITE, and ALL privileges are controlled per user per database. A new non-admin user has no access to any database until they are specifically granted privileges to a database by an admin user.Non-admin users can the databases on which they have READ and/or WRITE permissions.

    Admin user management

    When you enable HTTP authentication, InfluxDB requires you to create at least one admin user before you can interact with the system.

    CREATE USER admin WITH PASSWORD '<password>' WITH ALL PRIVILEGES

    CREATE another admin user
    1. CREATE USER <username> WITH PASSWORD '<password>' WITH ALL PRIVILEGES

    CLI example:

    1. > CREATE USER paul WITH PASSWORD 'timeseries4days' WITH ALL PRIVILEGES
    2. >
    GRANT administrative privileges to an existing user
    1. GRANT ALL PRIVILEGES TO <username>

    CLI example:

    1. > GRANT ALL PRIVILEGES TO "todd"
    2. >
    REVOKE administrative privileges from an admin user

      CLI example:

      1. > REVOKE ALL PRIVILEGES FROM "todd"
      2. >
      SHOW all existing users and their admin status
      1. SHOW USERS

      CLI example:

      1. > SHOW USERS
      2. user      admin
      3. todd     false
      4. paul     true
      5. hermione false
      6. dobby    false

      Non-admin user management

      CREATE a new non-admin user

      CLI example:

      1. > CREATE USER todd WITH PASSWORD 'influxdb41yf3'
      2. > CREATE USER alice WITH PASSWORD 'wonder\'land'
      3. > CREATE USER "rachel_smith" WITH PASSWORD 'asdf1234!'
      4. > CREATE USER "monitoring-robot" WITH PASSWORD 'XXXXX'
      5. > CREATE USER "$savyadmin" WITH PASSWORD 'm3tr1cL0v3r'
      6. >

      Notes:

      • The user value must be wrapped in double quotes if it starts with a digit, is an InfluxQL keyword, contains a hyphen and or includes any special characters, for example: !@#$%^&*()-
      • The password must be wrapped in single quotes.
      • Do not include the single quotes when authenticating requests.

      For passwords that include a single quote or a newline character, escape the single quote or newline character with a backslash both when creating the password and when submitting authentication requests.

      • Repeating the exact CREATE USER statement is idempotent. If any values change the database will return a duplicate user error. See GitHub Issue #6890 for details.

      CLI example:

      GRANT READ, WRITE or ALL database privileges to an existing user
      1. GRANT [READ,WRITE,ALL] ON <database_name> TO <username>

      CLI examples:

      GRANT READ access to todd on the NOAA_water_database database:

      1. > GRANT READ ON "NOAA_water_database" TO "todd"
      2. >

      GRANT ALL access to todd on the NOAA_water_database database:

      1. > GRANT ALL ON "NOAA_water_database" TO "todd"
      2. >
      REVOKE READ, WRITE, or ALL database privileges from an existing user
      1. REVOKE [READ,WRITE,ALL] ON <database_name> FROM <username>

      CLI examples:

      REVOKE ALL privileges from todd on the NOAA_water_database database:

      1. > REVOKE ALL ON "NOAA_water_database" FROM "todd"
      2. >

      REVOKE WRITE privileges from todd on the NOAA_water_database database:

      1. > REVOKE WRITE ON "NOAA_water_database" FROM "todd"
      2. >
      SHOW a user’s database privileges
      1. SHOW GRANTS FOR <user_name>

      CLI example:

      1. > SHOW GRANTS FOR "todd"
      2. database                    privilege
      3. NOAA_water_database            WRITE
      4. another_database_name          READ
      5. yet_another_database_name   ALL PRIVILEGES
      6. one_more_database_name      NO PRIVILEGES

      General admin and non-admin user management

      ReSET a user’s password
      1. SET PASSWORD FOR <username> = '<password>'

      CLI example:

      1. > SET PASSWORD FOR "todd" = 'influxdb4ever'

      Note: The password string must be wrapped in single quotes. Do not include the single quotes when authenticating requests. For passwords that include a single quote or a newline character, escape the single quote or newline character with a backslash both when creating the password and when submitting authentication requests.

      DROP a user
      1. DROP USER <username>

      CLI example:

      Requests with no authentication credentials or incorrect credentials yield the HTTP 401 Unauthorized response.