Manage users and permissions

Permissions required to complete the steps below

To complete the steps described in this article, you need to be designated as an organization owner.

These instructions explain how to:

To perform all the actions in these instructions, open your project's Members page.

Revoke an invitation

Under Pending invitations, find an invitation you want to revoke.
On the right side of the line, click → Revoke.
Click Revoke to confirm.

Resend an invitation

Under Pending invitations, find the invitation you want to resend.
On the right side of the line, click → Resend invitation.

Change permissions for an active member

Under Active members, find the user you want to edit permissions for.

Note

Please keep in mind that you can't downgrade the user's organization-level permissions within the project.
On the right side of the line, click → Edit permissions.
In the dialog window, use the dropdown lists to assign user permissions and click Submit:

<-- screenshot here -->

You'll see the active roles in the user's Role column.

Create a ClickHouse® user with read-only permission

The read-only permission doesn't allow access to connection strings of your Managed ClickHouse® clusters. If you want to provide access to a cluster, create a standalone user with read-only permissions for each Managed ClickHouse® cluster on your project:

Install the clickhouse-client:

Docker

DEB-based

RPM-based

Open your terminal.
(Optional) Start Docker if needed:
```
sudo service docker start
```

Pull the clickhouse-client Docker image:

docker pull clickhouse/clickhouse-client

Open your terminal.

Connect to the ClickHouse® official DEB repository from your Linux system:

sudo apt update && sudo apt install -y apt-transport-https ca-certificates dirmngr && \
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 8919F6BD2B48D754 && \
echo "deb https://packages.clickhouse.com/deb stable main" | sudo tee \
/etc/apt/sources.list.d/clickhouse.list

Refresh the package list and install the clickhouse-client :

sudo apt update && sudo apt install -y clickhouse-client

Open your terminal.

Connect to a ClickHouse® official RPM repository from your Linux system:

sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo

Install the clickhouse-client :
```
sudo yum install -y clickhouse-client
```

Warning

If you run a RedHat 7-based Linux distribution, including Cent OS 7, Oracle Linux 7 and others, you need to download and install trusted certificates and manually add the path to them in the clickhouse-client configuration file as follows:

Install the root certificate:

curl https://letsencrypt.org/certs/isrg-root-x2-cross-signed.pem > \ 
/etc/pki/ca-trust/source/anchors/isrg-root-x2-cross-signed.pem

Install the intermediate certificate:

curl https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem > \
/etc/pki/ca-trust/source/anchors/lets-encrypt-r3-cross-signed.pem

Update the list of trusted certificates:
```
sudo update-ca-trust
```

Locate your clickhouse-client configuration file (by default, you can find it at /etc/clickhouse-client/config.xml) and add the path to the certificates into the <openSSL> section:

<client> <!-- Used for connection to server's secure tcp port -->
   <loadDefaultCAFile>true</loadDefaultCAFile>
   <cacheSessions>true</cacheSessions>
   <disableProtocols>sslv2,sslv3</disableProtocols>
   <preferServerCiphers>true</preferServerCiphers>
   <caConfig>/etc/ssl/certs/ca-bundle.crt</caConfig>
   <!-- Use for self-signed: <verificationMode>none</verificationMode> -->
   <invalidCertificateHandler>
   <!-- Use for self-signed: <name>AcceptCertificateHandler</name> -->
   <name>RejectCertificateHandler</name>
   </invalidCertificateHandler>
</client>

Connect to your cluster with a connection string:

Go to the Clusters overview page in the console.
Under Connection strings, find the Native interface string and click Copy.

Open your terminal and run a command to connect to your cluster:

Docker

Native clickhouse-client

docker run --network host --rm -it clickhouse/<Native interface connection string>

The complete Docker command structure

docker run --network host --rm -it \ 
            clickhouse/clickhouse-client \
            --host <FQDN of your cluster> \
            --secure \
            --user <cluster user name> \
            --password <cluster user password> \
            --port 9440

<Native interface connection string>

Create a user and its password:

CREATE USER IF NOT EXISTS <user_name> ON CLUSTER <cluster ID> IDENTIFIED BY '<password>'

Assign the read-only rights to the newly created user:
```
GRANT SHOW TABLES, SELECT ON database.* TO <user_name>
```
Now the user can see the tables and perform SELECT queries with all the databases on the cluster.

For convenience, create a custom connection string for the new user:

clickhouse-client --host <FQDN of the host> \
                  --secure \
                  --user <Cluster user name> \
                  --password <Cluster user password> \
                  --port 9440

Delete an active member from the project

Under Active members, select the user you want to delete from the project.
On the right side of the line, click → Delete.
In the popup window, check the I want to revoke permissions to project box and click Delete.