Set up internal Kapacitor authorizations

Use user-based authorizations and permissions stored in Kapacitor to authenticate requests to the Kapacitor HTTP API.

Use Kapacitor authorizations

1. Create an admin user:

   1. Set the following in the [auth] configuration group in your kapacitor.conf:

      • enabled: true
      • bcrypt: an integer greater than or equal to 4
      • meta-*: empty string or false

      [auth]
        enabled = true
        cache-expiration = "1h"
        bcrypt-cost = 4
        meta-addr = ""
        meta-username = ""
        meta-password = ""
        meta-use-tls = false
        meta-ca = ""
        meta-cert = ""
        meta-key = ""
        meta-insecure-skip-verify = false
      

      Or use environment variables to set these configuration options:

      export KAPACITOR_AUTH_ENABLED=true
      export KAPACITOR_AUTH_BCRYPT=4
      

   2. Start kapacitord using the updated configuration:

      kapactord -config /path/to/kapacitor.conf
      

   3. Use the /users endpoint of the Kapacitor HTTP API to create a new admin user. In the request body, provide a JSON object with the following fields:

      • name: admin username
      • password: admin password
      • type: "admin"

      curl --request POST 'http://localhost:9092/kapacitor/v1/users' \
        --data '{
          "name": "exampleUsername",
          "password": "examplePassword",
          "type":"admin"
      }'
      

2. Stop the kapacitord service.

3. Set [http].auth-enabled to true in your kapacitor.conf:

   [http]
     #...
     auth-enabled: true
     #...
   

   Or use the KAPACITOR_HTTP_AUTH_ENABLED environment variable:

   export KAPACITOR_HTTP_AUTH_ENABLED=true
   

4. Restart kapacitord with the updated configuration.

   kapacitord -config /path/to/kapacitor.conf
   

5. (Optional) Create additional users with user-specific permissions. For more information, see:

   • Kapacitor HTTP API – Create a user
   • Kapacitor user types and permissions

Authenticate with the Kapacitor CLI

To authenticate with Kapacitor when using the kapacitor CLI, provide your username and password as part of the Kapacitor -url:

# Syntax
kapacitor -url http://<username>:<password>@localhost:9092

# Example
kapacitor -url http://admin:Pa5sw0Rd@localhost:9092

Authenticate with the Kapacitor API

To authenticate directly with the Kapacitor API, use basic authentication to provide your username and password.

# Syntax
curl --request GET http://localhost:9092/kapacitor/v1/tasks \
  -u "<username>:<password>" 

# Example
curl --request GET http://localhost:9092/kapacitor/v1/tasks \
  -u "johndoe:Pa5sw0Rd"