ByteHouse separates IAM accounts and Database accounts, allows independent creation of database accounts, and grants resource and data permissions to these accounts. You can access the ByteHouse database through the CLI, BI Tools, ELT Tools, IDE Tools, API, and others. This document explains how to create and use database accounts.

Database users are sub-users and cannot access the Volcano Console. They are only granted the maximum USE permission for computing group resources, and granting ALL permission will not activate.

1. Log in to the ByteHouse Console, in the ad_auth_management>User page, click Create User>Create Database User.
   

2. On the Create Database User page, configure the user information.
   

   Parameter	Configuration Description
   Username	Fill in a custom username, with the following naming rules: Supports Chinese and English letters, digits, strikethrough "-" and underline "_"; A maximum of 64 characters can be set. Usernames must not be repeated.
   Password	The password for the database account connection must be customized by the user, with the following naming rules: The length must be between 8 and 30 characters. Passwords must not start with "/" or "$6$". Must include uppercase letters A–Z. Must include lowercase letters a–z.
   Parameter Settings	Configure the default compute group and default write compute group for the account. After assigning a compute group to users, the system will also grant USE permissions of that compute group to the user. Subsequent modifications can be made in the Permission Management > Resource Management module, as detailed in Resource Access ManagementFor details, see. Default Calculation Group: The default calculation group for the current account, used for default computational resources to process SQL. Default Write Calculation Group: The default calculation group for writing in the current environment, used as the default computational resource for writing data into the underlying database storage. If the default write calculation group is configured in the current environment, the system will automatically use this group. You do not need to configure it, as the account's default write calculation group will automatically update to follow the environment’s default group. If no default write calculation group has been configured in the current environment, please first visitthe Tenant Management>Parameter Setting page to configure it, as detailed inManage Database Accounts.
   Description	Add a detailed description to the account, supporting up to 200 characters.

3. After configuring the user information, click create. Once created, you can view account-related information in the user list.

Step One: Grant environmental permissions to the database account #

1. Log in to the ByteHouse Console, on the ad_auth_management>User page, click to authorize the environment.
   
2. Select the current environment from the environment list, and click User authorization.
   
3. On the User authorization page, search by username to grant the user environment usage rights.
   
4. Click Confirm to complete the environment authorization.

Step Two: Grant resource and data permissions to the database account #

You can grant resources and data permissions to the account through Authorize and Authorize methods.

Prerequisites #

If you need to grant permissions to an account by assigning roles, please first create the roles and prepare the roles to be granted to the account.
In the ByteHouse Console, navigate through ad_auth_management>Roles path, click on Create Gamerole. For activity details, see Role managementdocument.

Steps #

1. Log in to the ByteHouse Console, on the ad_auth_management>User page, click on the Username to access the user authorization page.
   

2. You can grant resource and data permissions to accounts either by assigning roles or by direct authorization as required.

   Authorization Method	Action Steps
   Grant Roles	In theUser List Page, switch to theGranted Roles tab and clickGrant Role. In the role granting page, select the roles to be granted to the account. Click Confirm to complete the authorization.
   Authorize directly	In the Resource Permissions or Data Permissions page, switch to the Authorize Directly tab and click Authorize Directly. In the permission management page, assign the appropriate computing group resource permissions or data permissions to the account. warning You can grant the database account the default compute group and default write compute group USE and VIEW permissions; it is suggested to configure default compute group and default write compute group USE permissions for the account. If only the VIEW permission is granted, the account will not be able to execute SQL queries after connecting to ByteHouse. If the account will be used to access/read and write to databases in the future, grant the necessary data permissions to the account as needed. Click Confirm to complete the authorization.

   After completing the account authorization, you can view the details of the permissions granted to the account under the Resources Permission and Data Permission tabs.
   
   You can view the roles granted authorization by the user in the Granted Roles tab. You can revoke a role's privilege from the user using the Revoke button.
   

After creating the database account, you can reset the password and adjust the account settings.

Reset Password #

1. In the user list, click the Reset Password button in the action column corresponding to the username.
   
2. In the sidebar popup, enter and confirm the new password.
3. Click Confirm Reset to complete the password reset.

Adjust Account Parameter Settings #

1. In the user list, click the Parameter Setting button in the operation column corresponding to the username.
   
2. In the popup window, select the default compute group.
   
3. Click Confirm Change to complete the parameter settings.

1. In the user list, click the Delete button in the operation column corresponding to the username.
   
2. In the popup window, input the account name to be deleted.
3. Click Confirm Deletion.

You can connect to the ByteHouse database through CLI, BI tools, ELT tools, IDE tools, API, and others using the database account and API Key. For operation details, please refer to the following documents: