Operator Summary

The table below summarizes the AFL operators that manipulate user accounts.  Some of these operations can be done using the spaam.py example account management script, described further below.

The scidbadmin Account

SciDB Enterprise Edition is distributed with a single pre-configured user account called scidbadmin.  This is the database administrator account, and has all privileges associated with the admin role (see Roles).

Initially, use iquery to log in to the scidbadmin account with the following authentication file (see Using iquery in Security Mode):

{
  "user-name": "scidbadmin",
  "user-password": "Paradigm4"
}

Creating User Accounts

User accounts may be created by the scidbadmin user or by any user account belonging to the admin or operator roles.

Creating User Accounts with spaam.py

The spaam.py script (SciDB Password And Account Management) is a command line utility for simplifying adding user accounts and changing user passwords.  It is installed into /opt/scidb/<version>/bin.

Use the -a/--add command option to create a user account with spaam.py.  You must supply an initial password when creating a user account.  Spaam.py lets you provide the initial password using the terminal, or on standard input.  The following examples create user accounts todd and diane using each technique.

$ spaam.py --add todd
Password: 
Re-enter password: 
Query was executed successfully
$ 

Alternatively,

$ echo "big secret" | spaam.py --add diane --stdin
Query was executed successfully
$

Creating User Accounts Directly with AFL

The spaam.py -a/–add command option works by issuing an iquery command that uses the AFL create_user operator to create user accounts.  This operator takes two string parameters, the name of the user account to create, and a password hash.  Password hashes are base64-encoded SHA-512 hash digests of the user's cleartext password.  Here is an excerpt from the spaam.py script showing how password hashes are generated in Python:

import base64
import hashlib

# Intervening code deleted...

pwhash = base64.b64encode(hashlib.sha512(cleartext).digest())

In the Linux shell, you can generate password hashes using the openssl(1) and base64(1) commands.

$ PWHASH=$(echo -n $CLEARTEXT | openssl dgst -binary -sha512 | base64 -w 0)

Having generated a password hash, paste it into an AFL query to create a user account.

$ PWHASH=$(echo -n "big secret" | openssl dgst -binary -sha512 | base64 -w 0)
$ echo $PWHASH
8iOHY9qc4gk0L91I5CY1m9A7xgNJVWSFns6PkqhwLnb+PIVdyvED4m8COD4/nMF/7xbqmwVEoSQEN7J8fC6Drg==
$ iquery -a
AFL% create_user('diane', '8iOHY9qc4gk0L91I5CY1m9A7xgNJVWSFns6PkqhwLnb+PIVdyvED4m8COD4/nMF/7xbqmwVEoSQEN7J8fC6Drg==');
Query was executed successfully
AFL% quit;
$

Deleting User Accounts

User accounts are easily deleted directly in AFL.  This example deletes the accounts added in the previous section.

$ iquery -aq "drop_user('diane') ; drop_user('todd')"
Query was executed successfully
Query was executed successfully
$

Suspending User Accounts

In some circumstances you may prefer to disable a user account rather than remove it entirely.  You can do this with the spaam.py script.

$ spaam.py --suspend andrew
Suspended user andrew
$ 

You can later reactivate the account with the --allow option.

$ spaam.py --allow andrew
Allowed user andrew
$ 

Changing User Account Passwords

Changing User Account Passwords with spaam.py

The spaam.py script (SciDB Password And Account Management) is a command line utility for simplifying adding user accounts and changing user passwords.  It is installed into /opt/scidb/<version>/bin.

Use the -m/--modify command option to change a user account password with spaam.py.  You can provide the new password on the terminal, or on standard input.  Non-privileged users may change their own passwords without assistance from an operator or administrator.  This example changes the password of user alice (twice).

$ spaam.py --modify alice
New alice password: 
Re-enter password: 
Query was executed successfully
$
$ echo "even bigger secret" | spaam.py -m alice --stdin
Query was executed successfully
$

Changing User Account Passwords Directly with AFL

Generate a password hash as described in 253689868 above.  Paste it into an AFL change_user query.  This example uses a pre-computed password hash to change the password for user account fred .

$ iquery -a
AFL% create_user('password', 'fred', '8iOHY9qc4gk0L91I5CY1m9A7xgNJVWSFns6PkqhwLnb+PIVdyvED4m8COD4/nMF/7xbqmwVEoSQEN7J8fC6Drg==');
Query was executed successfully
AFL% quit;
$