Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/ Documentation version: v5.3.2 # User management Use [ngctl](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/) to create users, change passwords, enable, disable, unlock, and delete users in NebulaGraph Database Developer Edition. The Meta service manages user identities. The Graph service manages service group membership, roles, and privileges. After creating a user, [configure access](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/) separately. The supplied deployment names the service group `default_svcgrp`. ## Prerequisites Start NebulaGraph Database Developer Edition. Run the following `ngctl` commands inside the supplied `ngctl` container. Administrative operations such as creating users, deleting users, and resetting passwords require you to sign in to the Meta service as `root`. You do not need to sign in first to [change a password](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/#change-own-password). 1. In the development machine's terminal, open the directory containing `compose.yaml` and enter the container: ```` docker compose exec ngctl sh ```` 2. For administrative operations, sign in to the Meta service. Replace `` with the current `root` password: ```` ngctl auth login -H graph-cluster -P 9559 -u root -p '' ```` Enter the actual password characters: `$$` in the Compose file represents a single `$` here. See [Run ngctl with Docker Compose](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/#docker-compose). For a separately installed tool, see [Log in to the Meta service](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#log_in_to_meta). ## Create users Create `user1` and set its password: ```` ngctl user create user1 --password Passwd123 ```` The command returns `Create user successfully.` New users are enabled by default but have not joined the service group. Specify the password through authentication information This alternative creates the same user. Choose one form: ```` ngctl user create user1 --auth-type password --auth-info '{"password":"Passwd123"}' ```` For command options, see [Create user](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#create_user). ## Enable a user to access a service group After creating the user, switch to a GQL client and [connect to the Graph service](https://dev-docs.nebula-graph.io/v5.3.2/get-started/first-query/#connect) as the service group owner. The owner holds the built-in `ADMIN` role. 1. Invite the user and grant the connection privilege: ```` ''' INVITE USER user1 ''' ''' GRANT CONNECT TO USER user1 ''' ```` 2. Follow [Configure user access](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/) to grant roles or resource privileges. Access to a non-default schema requires `USAGE` on that schema. Querying a graph also requires `MATCH` on the graph. 3. Check membership with [SHOW USERS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-users/), inspect grants with [SHOW ROLES FOR USER](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-roles/) and [SHOW PRIVILEGES FOR USER](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-privileges/), then connect as `user1` and perform the intended operation. A home schema or home graph sets the default selection after login. It does not grant resource privileges. See [INVITE USER](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/invite-user/). ## Stop user access Choose the operation for the access you need to stop: | Goal | Operation | Effect | Prevent new connections to the service group | Revoke `CONNECT` | Preserves the user and other privileges. Existing sessions remain open. | Remove specific action privileges | [Revoke roles or privileges](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/manage-roles/) | Removes only the specified grant source. | Remove the user from the service group | [REMOVE USER](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/remove-user/) | Removes membership, roles, and privileges in the service group, while preserving the Meta user. | Prevent new password-authenticated connections | `ngctl user disable` | Preserves the user, membership, and grants. Stop sessionless access separately. | Permanently delete the user | `ngctl user drop` | Deletes the Meta user and removes the user from the service group. To end existing sessions after revoking `CONNECT`, find them with [SHOW SESSIONS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-sessions/) and terminate them with [KILL SESSION](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/kill/kill-session/). ## Delete users You cannot delete `root` or the service group owner. Deleting a user Deletion removes the user from the service group and deletes its membership and grants. To stop password-authenticated connections temporarily, [disable the user](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/#enable_or_disable_users). ```` ngctl user drop user1 ```` For command options, see [Drop user](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#drop_user). ## Password management ### Change a password Use `ngctl auth passwd` to verify your identity with your current password. You do not need to sign in to the Meta service first. The new password must contain at least eight characters, including an uppercase letter, a lowercase letter, and a digit. Replace ``, ``, and `` with your username, current password, and new password: ```` ngctl auth passwd -H graph-cluster -P 9559 -u '' -c '' -p '' ```` The command returns `Change password succeeded.` If you have forgotten your current password, ask an administrator to [reset it](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/#reset-user-password). For command options, see [Change a password](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#change_meta_password). ### Reset a user's password as an administrator [Sign in to the Meta service as `root`](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/#prerequisite_for_managing_the_user_lifecycle), then use `ngctl user alter` to set a new password for the target user. You do not need that user's old password. This example resets `user1`'s password to `Nebula5678`: ```` ngctl user alter user1 --password Nebula5678 ```` The command returns `Alter user successfully.` Reset the password through authentication information This form is equivalent to the preceding command. Choose one: ```` ngctl user alter user1 --auth-info '{"password":"Nebula5678"}' ```` If the target user is disabled, [enable the user](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/#enable_or_disable_users) before resetting the password. Disable the user again afterward if it must remain disabled. For command options, see [Reset a user's password as an administrator](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#change_user_password). If you change the deployment account's `root` password with either method, also update the Compose configuration as described in [Change the root password of an existing NebulaGraph Database Developer Edition instance](https://dev-docs.nebula-graph.io/v5.3.2/get-started/deploy/#change-root-password). ## Enable or disable users Disable a user to prevent new password-authenticated connections: ```` ngctl user disable user1 ```` Enable the user again: ```` ngctl user enable user1 ```` Neither operation removes membership, roles, or privileges. After being enabled, the user can reconnect once all requirements, including `CONNECT`, are met. Sessionless access Sessionless mode skips Meta user authentication. Disabling the user set by `sessionless_user` does not stop this access. See [Disable sessionless mode](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/sessionless/#disable-sessionless). For command options, see [Disable user](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#disable_user) and [Enable user](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#enable_user). ## Unlock locked users Too many failed password logins within the configured time window can temporarily lock a user. The Meta service settings `max_allowed_login_attempts`, `user_locked_mins`, and `user_locked_window_mins` control this behavior. Clear a temporary lock manually: ```` ngctl user unlock user1 ```` `unlock` clears a lock caused by failed logins; `enable` re-enables a disabled user. For command options, see [Unlock user](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#unlock_user). ## Show users List all Meta users: ```` ngctl user show ```` Inspect one user: ```` ngctl user show user1 ```` `Name` is the username. `Active` shows whether the user is enabled: `Y` means enabled and `N` means disabled. This output does not include resource grants in the service group. Use the Graph service's `SHOW ROLES` and `SHOW PRIVILEGES` commands to inspect grants. For command options, see [Show users](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/meta-commands/#show_users).