Manage users and permissions
Permissions required to complete the steps below
To complete the steps described in this article, you need to be designated as an organization owner.
These instructions explain how to:
- Revoke an invitation
- Resend an invitation
- Change permissions for an active member
- Delete an active member from the project
To perform all the actions in these instructions, open your project's Members page.
Revoke an invitation
-
Under Pending invitations, find an invitation you want to revoke.
-
On the right side of the line, click
-
Click Revoke to confirm.
Resend an invitation
-
Under Pending invitations, find the invitation you want to resend.
-
On the right side of the line, click
Change permissions for an active member
-
Under Active members, find the user you want to edit permissions for.
Note
Please keep in mind that you can't downgrade the user's organization-level permissions within the project.
-
On the right side of the line, click
-
In the dialog window, use the dropdown lists to assign user permissions and click Submit:
<-- screenshot here -->
You'll see the active roles in the user's Role column.
Create a ClickHouse® user with read-only permission
The read-only
permission doesn't allow access to connection strings of your Managed ClickHouse® clusters. If you want to provide access to a cluster, create a standalone user with read-only permissions for each Managed ClickHouse® cluster on your project:
-
Install the clickhouse-client:
DockerDEB-basedRPM-based-
Open your terminal.
-
(Optional) Start Docker
sudo service docker start
-
Pull the clickhouse-client
docker pull clickhouse/clickhouse-client
-
Open your terminal.
-
Connect to the ClickHouse® official DEB repository
sudo apt update && sudo apt install -y apt-transport-https ca-certificates dirmngr && \ sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 8919F6BD2B48D754 && \ echo "deb https://packages.clickhouse.com/deb stable main" | sudo tee \ /etc/apt/sources.list.d/clickhouse.list
-
Refresh the package list and install the clickhouse-client
sudo apt update && sudo apt install -y clickhouse-client
-
Open your terminal.
-
Connect to a ClickHouse® official RPM repository
sudo yum install -y yum-utils sudo yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo
-
Install the clickhouse-client
sudo yum install -y clickhouse-client
Warning
If you run a RedHat 7-based Linux distribution, including Cent OS 7, Oracle Linux 7 and others, you need to download and install trusted certificates and manually add the path to them in the clickhouse-client configuration file as follows:
-
Install the
root
certificate:curl https://letsencrypt.org/certs/isrg-root-x2-cross-signed.pem > \ /etc/pki/ca-trust/source/anchors/isrg-root-x2-cross-signed.pem
-
Install the
intermediate
certificate:curl https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem > \ /etc/pki/ca-trust/source/anchors/lets-encrypt-r3-cross-signed.pem
-
Update the list of trusted certificates:
sudo update-ca-trust
-
Locate your clickhouse-client configuration file (by default, you can find it at
/etc/clickhouse-client/config.xml
) and add the path to the certificates into the<openSSL>
section:<client> <!-- Used for connection to server's secure tcp port --> <loadDefaultCAFile>true</loadDefaultCAFile> <cacheSessions>true</cacheSessions> <disableProtocols>sslv2,sslv3</disableProtocols> <preferServerCiphers>true</preferServerCiphers> <caConfig>/etc/ssl/certs/ca-bundle.crt</caConfig> <!-- Use for self-signed: <verificationMode>none</verificationMode> --> <invalidCertificateHandler> <!-- Use for self-signed: <name>AcceptCertificateHandler</name> --> <name>RejectCertificateHandler</name> </invalidCertificateHandler> </client>
-
-
Connect to your cluster with a connection string:
-
Go to the Clusters overview
-
Under Connection strings, find the Native interface string and click Copy.
-
Open your terminal and run a command to connect to your cluster:
DockerNative clickhouse-clientdocker run --network host --rm -it clickhouse/<Native interface connection string>
The complete Docker command structuredocker run --network host --rm -it \ clickhouse/clickhouse-client \ --host <FQDN of your cluster> \ --secure \ --user <cluster user name> \ --password <cluster user password> \ --port 9440
<Native interface connection string>
-
-
Create a user and its password:
CREATE USER IF NOT EXISTS <user_name> ON CLUSTER <cluster ID> IDENTIFIED BY '<password>'
-
Assign the read-only rights to the newly created user:
GRANT SHOW TABLES, SELECT ON database.* TO <user_name>
Now the user can see the tables and perform
SELECT
queries with all the databases on the cluster. -
For convenience, create a custom connection string for the new user:
clickhouse-client --host <FQDN of the host> \ --secure \ --user <Cluster user name> \ --password <Cluster user password> \ --port 9440
Delete an active member from the project
-
Under Active members, select the user you want to delete from the project.
-
On the right side of the line, click
-
In the popup window, check the I want to revoke permissions to project box and click Delete.