Skip to content
Developer Edition runs on one host and does not require a product license file. Need multi-host deployment or performance testing at scale? Explore Enterprise Edition

User management

Use ngctl to create users, change passwords, enable, disable, unlock, and delete users in NebulaGraph Database Developer Edition.

The Meta service manages user identities. The Graph service manages service group membership, roles, and privileges. After creating a user, configure access separately. The supplied deployment names the service group default_svcgrp.

Prerequisites

Start NebulaGraph Database Developer Edition. Run the following ngctl commands inside the supplied ngctl container. Administrative operations such as creating users, deleting users, and resetting passwords require you to sign in to the Meta service as root. You do not need to sign in first to change a password.

  1. In the development machine's terminal, open the directory containing compose.yaml and enter the container:

    docker compose exec ngctl sh

  2. For administrative operations, sign in to the Meta service. Replace <root-password> with the current root password:

    ngctl auth login -H graph-cluster -P 9559 -u root -p '<root-password>'

    Enter the actual password characters: $$ in the Compose file represents a single $ here. See Run ngctl with Docker Compose. For a separately installed tool, see Log in to the Meta service.

Create users

Create user1 and set its password:

ngctl user create user1 --password Passwd123

The command returns Create user successfully. New users are enabled by default but have not joined the service group.

Specify the password through authentication information

This alternative creates the same user. Choose one form:

ngctl user create user1 --auth-type password --auth-info '{"password":"Passwd123"}'

For command options, see Create user.

Enable a user to access a service group

After creating the user, switch to a GQL client and connect to the Graph service as the service group owner. The owner holds the built-in ADMIN role.

  1. Invite the user and grant the connection privilege:

    '''
INVITE USER user1
'''

'''
GRANT CONNECT TO USER user1
'''

  2. Follow Configure user access to grant roles or resource privileges. Access to a non-default schema requires USAGE on that schema. Querying a graph also requires MATCH on the graph.

  3. Check membership with SHOW USERS, inspect grants with SHOW ROLES FOR USER and SHOW PRIVILEGES FOR USER, then connect as user1 and perform the intended operation.

A home schema or home graph sets the default selection after login. It does not grant resource privileges. See INVITE USER.

Stop user access

Choose the operation for the access you need to stop:

Goal Operation Effect
Prevent new connections to the service group Revoke CONNECT Preserves the user and other privileges. Existing sessions remain open.
Remove specific action privileges Revoke roles or privileges Removes only the specified grant source.
Remove the user from the service group REMOVE USER Removes membership, roles, and privileges in the service group, while preserving the Meta user.
Prevent new password-authenticated connections ngctl user disable Preserves the user, membership, and grants. Stop sessionless access separately.
Permanently delete the user ngctl user drop Deletes the Meta user and removes the user from the service group.

To end existing sessions after revoking CONNECT, find them with SHOW SESSIONS and terminate them with KILL SESSION.

Delete users

You cannot delete root or the service group owner.

Deleting a user

Deletion removes the user from the service group and deletes its membership and grants. To stop password-authenticated connections temporarily, disable the user.

ngctl user drop user1

For command options, see Drop user.

Password management

Change a password

Use ngctl auth passwd to verify your identity with your current password. You do not need to sign in to the Meta service first. The new password must contain at least eight characters, including an uppercase letter, a lowercase letter, and a digit.

Replace <username>, <current-password>, and <new-password> with your username, current password, and new password:

ngctl auth passwd -H graph-cluster -P 9559 -u '<username>' -c '<current-password>' -p '<new-password>'

The command returns Change password succeeded. If you have forgotten your current password, ask an administrator to reset it. For command options, see Change a password.

Reset a user's password as an administrator

Sign in to the Meta service as root, then use ngctl user alter to set a new password for the target user. You do not need that user's old password. This example resets user1's password to Nebula5678:

ngctl user alter user1 --password Nebula5678

The command returns Alter user successfully.

Reset the password through authentication information

This form is equivalent to the preceding command. Choose one:

ngctl user alter user1 --auth-info '{"password":"Nebula5678"}'

If the target user is disabled, enable the user before resetting the password. Disable the user again afterward if it must remain disabled.

For command options, see Reset a user's password as an administrator.

If you change the deployment account's root password with either method, also update the Compose configuration as described in Change the root password of an existing NebulaGraph Database Developer Edition instance.

Enable or disable users

Disable a user to prevent new password-authenticated connections:

ngctl user disable user1

Enable the user again:

ngctl user enable user1

Neither operation removes membership, roles, or privileges. After being enabled, the user can reconnect once all requirements, including CONNECT, are met.

Sessionless access

Sessionless mode skips Meta user authentication. Disabling the user set by sessionless_user does not stop this access. See Disable sessionless mode.

For command options, see Disable user and Enable user.

Unlock locked users

Too many failed password logins within the configured time window can temporarily lock a user. The Meta service settings max_allowed_login_attempts, user_locked_mins, and user_locked_window_mins control this behavior.

Clear a temporary lock manually:

ngctl user unlock user1

unlock clears a lock caused by failed logins; enable re-enables a disabled user. For command options, see Unlock user.

Show users

List all Meta users:

ngctl user show

Inspect one user:

ngctl user show user1

Name is the username. Active shows whether the user is enabled: Y means enabled and N means disabled. This output does not include resource grants in the service group. Use the Graph service's SHOW ROLES and SHOW PRIVILEGES commands to inspect grants.

For command options, see Show users.