Documentation

Add a user to your InfluxDB cluster

Add a user with administrative access to your InfluxDB cluster through your identity provider and your InfluxDB AppInstance resource:

  1. Use your identity provider to create an OAuth2 account for the user that needs administrative access to your InfluxDB cluster.

    Refer to your identity provider’s documentation for information about adding users:

  2. Add the user to your InfluxDB AppInstance resource. You can edit your AppInstance resource directly in your myinfluxdb.yml, or, if you’re using the InfluxDB Clustered Helm chart, you can add users to your values.yaml to modify your AppInstance resource. Required credentials depend on your identity provider.

    If editing your AppInstance resource directly, provide values for the following fields in your myinfluxdb.yml configuration file:

    • spec.package.spec.admin
      • identityProvider: Identity provider name. If using Microsoft Entra ID (formerly Azure Active Directory), set the name to azure.
      • jwksEndpoint: JWKS endpoint provide by your identity provider.
      • users: List of OAuth2 users to grant administrative access to your InfluxDB cluster. IDs are provided by your identity provider.

    Below are examples for Keycloak, Auth0, and Microsoft Entra ID, but other OAuth2 providers should work as well:

    apiVersion: kubecfg.dev/v1alpha1
    kind: AppInstance
    # ...
    spec:
      package:
        spec:
          admin:
            identityProvider: keycloak
            jwksEndpoint: |-
              https://
    KEYCLOAK_HOST
    /auth/realms/
    KEYCLOAK_REALM
    /protocol/openid-connect/certs
    users: # All fields are required but `firstName`, `lastName`, and `email` can be # arbitrary values. However, `id` must match the user ID provided by Keycloak. - id:
    KEYCLOAK_USER_ID
    firstName: Marty lastName: McFly email: mcfly@influxdata.com

    Replace the following:

    • KEYCLOAK_HOST: Host and port of your Keycloak server
    • KEYCLOAK_REALM: Keycloak realm
    • KEYCLOAK_USER_ID: Keycloak user ID to grant InfluxDB administrative access to (See Find user IDs with Keycloak)

    apiVersion: kubecfg.dev/v1alpha1
    kind: AppInstance
    # ...
    spec:
      package:
        spec:
          admin:
            identityProvider: auth0
            jwksEndpoint: |-
              https://
    AUTH0_HOST
    /.well-known/openid-configuration
    users: # All fields are required but `firstName`, `lastName`, and `email` can be # arbitrary values. However, `id` must match the user ID provided by Auth0. - id:
    AUTH0_USER_ID
    firstName: Marty lastName: McFly email: mcfly@influxdata.com

    Replace the following:

    • AUTH0_HOST: Host and port of your Auth0 server
    • AUTH0_USER_ID: Auth0 user ID to grant InfluxDB administrative access to

    apiVersion: kubecfg.dev/v1alpha1
    kind: AppInstance
    # ...
    spec:
      package:
        spec:
          admin:
            identityProvider: azure
            jwksEndpoint: |-
              https://login.microsoftonline.com/
    AZURE_TENANT_ID
    /discovery/v2.0/keys
    users: # All fields are required but `firstName`, `lastName`, and `email` can be # arbitrary values. However, `id` must match the user ID provided by Azure. - id:
    AZURE_USER_ID
    firstName: Marty lastName: McFly email: mcfly@influxdata.com

    Replace the following:


    If using the InfluxDB Clustered Helm chart, provide values for the following fields in your values.yaml:

    • admin
      • identityProvider: Identity provider name. If using Microsoft Entra ID (formerly Azure Active Directory), set the name to azure.
      • jwksEndpoint: JWKS endpoint provide by your identity provider.
      • users: List of OAuth2 users to grant administrative access to your InfluxDB cluster. IDs are provided by your identity provider.

    Below are examples for Keycloak, Auth0, and Microsoft Entra ID, but other OAuth2 providers should work as well:

    admin:
      # The identity provider to be used (such as "keycloak", "auth0", or "azure")
      # Note, use "azure" for Azure Active Directory
      identityProvider: keycloak
      # The JWKS endpoint provided by the Identity Provider
      jwksEndpoint: |-
        https://
    KEYCLOAK_HOST
    /auth/realms/
    KEYCLOAK_REALM
    /protocol/openid-connect/certs
    # The list of users to grant access to Clustered via influxctl users: # All fields are required but `firstName`, `lastName`, and `email` can be # arbitrary values. However, `id` must match the user ID provided by Keycloak. - id:
    KEYCLOAK_USER_ID
    firstName: Marty lastName: McFly email: mcfly@influxdata.com

    Replace the following:

    • KEYCLOAK_HOST: Host and port of your Keycloak server
    • KEYCLOAK_REALM: Keycloak realm
    • KEYCLOAK_USER_ID: Keycloak user ID to grant InfluxDB administrative access to

    admin:
      # The identity provider to be used e.g. "keycloak", "auth0", "azure", etc
      # Note, use "azure" for Azure Active Directory.
      identityProvider: auth0
      # The JWKS endpoint provided by the Identity Provider
      jwksEndpoint: |-
        https://
    AUTH0_HOST
    /.well-known/openid-configuration
    # The list of users to grant access to Clustered via influxctl users: # All fields are required but `firstName`, `lastName`, and `email` can be # arbitrary values. However, `id` must match the user ID provided by Auth0. - id:
    AUTH0_USER_ID
    firstName: Marty lastName: McFly email: mcfly@influxdata.com

    Replace the following:

    • AUTH0_HOST: Host and port of your Auth0 server
    • AUTH0_USER_ID: Auth0 user ID to grant InfluxDB administrative access to

    admin:
      # The identity provider to be used e.g. "keycloak", "auth0", "azure", etc
      # Note, use "azure" for Azure Active Directory.
      identityProvider: azure
      # The JWKS endpoint provided by the Identity Provider
      jwksEndpoint: |-
        https://login.microsoftonline.com/
    AZURE_TENANT_ID
    /discovery/v2.0/keys
    # The list of users to grant access to Clustered via influxctl users: # All fields are required but `firstName`, `lastName`, and `email` can be # arbitrary values. However, `id` must match the user ID provided by Azure. - id:
    AZURE_USER_ID
    firstName: Marty lastName: McFly email: mcfly@influxdata.com

    Replace the following:


  3. Apply the change to your InfluxDB cluster.

    • If updating the AppInstance resource directly, use kubectl to apply the change.
    • If using the InfluxDB Clustered Helm chart, use helm to apply the change.
kubectl apply \
  --filename myinfluxdb.yml \
  --namespace influxdb
helm upgrade \
  influxdb \
  influxdata/influxdb3-clustered \
  -f ./values.yaml \
  --namespace influxdb

Once applied, the added user is granted administrative access to your InfluxDB cluster and can use influxctl to perform administrative actions. See Set up Authorization–Configure influxctl for information about configuring the new user’s influxctl client to communicate and authenticate with your InfluxDB cluster’s identity provider.


Was this page helpful?

Thank you for your feedback!


The future of Flux

Flux is going into maintenance mode. You can continue using it as you currently are without any changes to your code.

Read more

InfluxDB v3 enhancements and InfluxDB Clustered is now generally available

New capabilities, including faster query performance and management tooling advance the InfluxDB v3 product line. InfluxDB Clustered is now generally available.

InfluxDB v3 performance and features

The InfluxDB v3 product line has seen significant enhancements in query performance and has made new management tooling available. These enhancements include an operational dashboard to monitor the health of your InfluxDB cluster, single sign-on (SSO) support in InfluxDB Cloud Dedicated, and new management APIs for tokens and databases.

Learn about the new v3 enhancements


InfluxDB Clustered general availability

InfluxDB Clustered is now generally available and gives you the power of InfluxDB v3 in your self-managed stack.

Talk to us about InfluxDB Clustered