A newer version of this documentation is available.

View Latest

Roles

      +
      A Couchbase role permits one or more resources to be accessed according to defined privileges.

      Roles and Privileges

      Couchbase roles each have a fixed association with a set of one or more privileges. Each privilege is associated with a resource. Privileges are actions such as Read, Write, Execute, Manage, Flush, and List; or a combination of some or all of these.

      Roles are of two kinds:

      • Administration and Global: Associated with cluster-wide privileges. Some of these roles are for administrators; who might manage cluster-configurations; or read statistics; or enforce security. Others are for users and user-defined applications that require access to specific, cluster-wide resources.

      • Per Bucket: Associated with one or more buckets. These roles support the reading and writing of bucket-settings; the management of services, indexes, and replication procedures; and access to data.

      When a user (meaning either an administrator or an application) attempts to access a resource, they must authenticate, by means of a username and password. The roles and privileges associated with these credentials are checked by Couchbase Server. If the associated roles contain privileges that support the kind of access that is being attempted, access is granted; otherwise, it is denied.

      Commonly Used Roles

      Couchbase Server users can largely be categorized as administrators, developers, and applications. Each user-category is supported by a different subset of roles.

      • Administrators. Able to log into Couchbase Web Console and perform administrative tasks; but unable to read or write data.

        The administrative tasks available are divided into multiple admin roles. For example, the Cluster Admin role allows the management of all cluster features except security; while the Read-Only Admin role allows only the reading of statistics; and the Bucket Admin role allows management only of one or more buckets. See the Admin roles listed below for full details. Note that depending on the administrator’s assigned roles, the content of Couchbase Web Console changes: for example, the Security screen is only visible to Full or Security administrators.

      • Applications. Able to read or write data; but unable to log into Couchbase Web Console, or in any way modify cluster-settings. For example, the Data Reader and Data Writer roles allows data to be respectively read and written to one or more buckets. Other application-intended roles are Application Access, Data DCP Writer, Data Backup & Restore, and Data Monitor. See below for details on each.

      • Developers. Can be given a selection of roles, allowing the right degree of data and console access. For example, the Read-Only Admin role allows the reading of cluster-statistics, while the Data Read and Data Write roles allow access to data on one or more buckets.

      The following list contains all roles supported by Couchbase Server, Enterprise Edition. Each role is explained by means of a description and (in most cases) a table: the table lists the privileges in association with resources. The header of each table states the role’s name, followed by its alias name in parentheses: alias names are used in commands and queries. In each table-body, where a privilege is associated with a resource, this is indicated with a check-mark. Where a privilege is not associated with a resource (or where association would not be applicable), this is indicated with a cross. Resources not referred to in a particular table have no privileges associated with them in the context of role being described.

      Note that some roles grant access to Couchbase Web Console; while others do not. The set of features displayed within the console varies, according to role.

      Note also that any authentication failure will be logged in the log file for the resource on which access was attempted. See Manage Logging, for detailed information on using log files.

      Full Admin

      The Full Admin role (an Administration and Global role) supports full access to all Couchbase-Server features and resources, including those of security. The role allows access to the Couchbase Web Console, and allows the reading and writing of bucket-data.

      This role is also available in Couchbase Server Community Edition.

      Cluster Admin

      The Cluster Admin role (an Administration and Global role) allows the management of all cluster features except security. The role allows access to Couchbase Web Console, but does not permit the writing of data.

      Role: Cluster Admin (cluster_admin)
      Resources Privileges
      Read Write Execute Manage

      Cluster (except Passwords)

      yes

      yes

      yes

      yes

      UI (except Passwords)

      yes

      yes

      yes

      yes

      Security (except Passwords)

      yes

      no

      no

      no

      Bucket Data

      no

      no

      no

      no

      Security Admin

      The Security Admin role (an Administration and Global role) allows the management of user roles and the reading of all cluster statistics. The role does not permit the granting of Full Admin or Security Admin roles, and does not permit the administrator to change their own role (which therefore remains Security Admin). The role supports access to Couchbase Web Console, but does not support the reading of data.

      Role: Security Admin (security_admin)
      Resources Privileges
      Read Write Execute Manage

      Cluster

      yes

      no

      no

      no

      UI (except Security)

      yes

      no

      no

      no

      Security (including UI)

      yes

      yes

      yes

      yes

      Bucket Data

      no

      no

      no

      no

      Read-Only Admin

      The Read-Only Admin role (an Administration and Global role) supports the reading of Couchbase Server-statistics: this includes registered usernames with roles and authentication domains, but excludes passwords. The role allows access to Couchbase Web Console.

      This role is also available in Couchbase Server Community Edition.

      Role: Read-Only Admin (ro_admin)
      Resources Privileges
      Read Write Execute Manage

      Cluster

      yes

      no

      no

      no

      UI (except Passwords)

      yes

      no

      no

      no

      Security (except Passwords)

      yes

      no

      no

      no

      Bucket Data

      no

      no

      no

      no

      XDCR Admin

      The XDCR Admin role (an Administration and Global role) allows use of XDCR features, to create cluster references and replication streams. The role allows access to Couchbase Web Console.

      Role: XDCR Admin (replication_admin)
      Resources Privileges
      Read Write Execute Manage

      XDCR for Cluster and Bucket

      yes

      yes

      yes

      yes

      Bucket Data

      yes

      no

      no

      no

      Bucket Settings

      yes

      no

      no

      no

      UI (XDCR)

      yes

      yes

      yes

      yes

      UI (Other)

      yes

      no

      no

      no

      Query Curl Access

      The Query Curl Access role (an Administration and Global role) allows the N1QL CURL function to be executed by an externally authenticated user. The user can access Couchbase Web Console, but cannot read data, other than that returned by the N1QL CURL function.

      Note that the Query Curl Access role should be assigned with caution, since it entails risk: CURL runs within the local Couchbase Server network; therefore, the assignee of the Query Curl Access role is permitted to run GET and POST requests on the internal network, while being themselves externally located.

      For an account of limitations on CURL, see CURL Function.

      In versions of Couchbase Server prior to 5.5, this role was referred to as Query External Access.

      Role: Query Curl Access (query_external_access)
      Resources Privileges
      Read Write Execute Manage

      Bucket : N1QL, curl

      no

      no

      yes

      no

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Query System Catalog

      The Query System Catalog role (an Administration and Global role) allows information to be looked up by means of N1QL in the system catalog: this includes system:indexes, system:prepareds, and tables listing current and past queries. This role is designed for troubleshooters, who need to debug queries. The role allows access to Couchbase Web Console, but does not permit the reading of bucket-items.

      Role: Query System Catalog (query_system_catalog)
      Resources Privileges
      Read Write Execute Manage List

      Bucket : N1QL, INDEX

      no

      no

      no

      no

      yes

      Bucket : N1QL, Meta

      yes

      no

      no

      no

      no

      UI

      yes

      no

      no

      no

      no

      Pools

      yes

      no

      no

      no

      no

      Analytics Reader

      The Analytics Reader role (an Administration and Global role) allows querying of shadow data-sets. The role allows access to Couchbase Web Console, and permits the reading of data.

      Role: Analytics Reader (analytics_reader)
      Resources Privileges
      Read Write Execute Manage

      Bucket : Analytics

      yes

      no

      no

      no

      Bucket : UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Bucket Admin

      The Bucket Admin role allows the management of all per bucket features (including starting and stopping XDCR). The role allows access to Couchbase Web Console, but does not permit the reading or writing of data.

      Role: Bucket Admin (bucket_admin)
      Resources Privileges
      Read Write Execute Manage

      Cluster

      yes

      no

      no

      no

      Bucket (including XDCR)

      yes

      yes

      yes

      yes

      Bucket Data

      no

      no

      no

      no

      Bucket UI

      yes

      yes

      yes

      yes

      Other UI

      yes

      no

      no

      no

      Application Access

      The Application Access role provides read and write access to data, per bucket. The role does not allow access to Couchbase Web Console: it is intended for applications, rather than users. Note that this role is also available in the Community Edition of Couchbase Server.

      The role is provided in support of buckets that were created on versions of Couchbase Server prior to 5.0. Such buckets were accessed by specifying bucket-name and bucket-password: however, bucket-passwords are not recognized by Couchbase Server 5.0 and after. Therefore, for each pre-existing bucket, the upgrade-process for 5.0 and after creates a new user, whose username is identical to the bucket-name; and whose password is identical to the former bucket-password, if one existed. If no bucket-password existed, the user is created with no password. This migration-process allows the same name-combination as before to be used in authentication. To ensure backwards compatibility, each system-created user is assigned the Application Access role, which authorizes the same read-write access to bucket-data as was granted before 5.0.

      Use of the Application Access role is deprecated for buckets created on Couchbase Server 5.0 and after: use the other bucket-access roles provided. Note that in versions of Couchbase Server prior to 5.5, this role was referred to as Bucket Full Access.

      Role: Application Access (bucket_full_access)
      Resources Privileges
      Read Write Execute Manage Flush

      Bucket Data

      yes

      yes

      yes

      yes

      no

      Bucket Views

      yes

      yes

      yes

      yes

      no

      N1QL: Index

      yes

      yes

      yes

      yes

      no

      N1QL: Other

      yes

      yes

      yes

      no

      no

      Bucket

      yes

      no

      no

      no

      yes

      Pools

      yes

      no

      no

      no

      no

      XDCR Inbound

      The XDCR Inbound role allows the creation of inbound XDCR streams, per bucket. It does not allow access to Couchbase Web Console, and does not permit the reading of data.

      In versions of Couchbase Server prior to 5.5, this role was referred to as Replication Target.

      Role: XDCR Inbound (replication_target)
      Resources Privileges
      Read Write Execute Manage

      Bucket : Settings

      yes

      no

      no

      no

      Bucket : Meta

      yes

      yes

      no

      no

      Bucket : Stats

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Data Reader

      The Data Reader role allows data to be read, per bucket. Note that the role does not permit the running of N1QL queries (such as SELECT) against data. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users.

      Role: Data Reader (data_reader)
      Resources Privileges
      Read Write Execute Manage

      Bucket Docs

      yes

      no

      no

      no

      Bucket : Meta

      yes

      no

      no

      no

      Bucket : Xattr

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Data Writer

      The Data Writer role allows data to be written, per bucket. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users.

      Role: Data Writer (data_writer)
      Resources Privileges
      Read Write Execute Manage

      Bucket : Docs

      no

      yes

      no

      no

      Bucket : Xattr

      no

      yes

      no

      no

      Pools

      yes

      no

      no

      no

      Data DCP Reader

      The Data DCP Reader role allows DCP streams to be initiated, per bucket. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users. The role does allow the reading of data.

      Role: Data DCP Reader (data_dcp_reader)
      Resources Privileges
      Read Write Execute Manage

      Bucket: : Docs

      yes

      no

      no

      no

      Bucket: : Meta

      yes

      no

      no

      no

      Bucket: : DCP

      yes

      no

      no

      no

      Bucket: : Sxattr

      yes

      no

      no

      no

      Bucket: : Xattr

      yes

      no

      no

      no

      Admin: Memcached: Idle

      no

      yes

      no

      no

      Pools

      yes

      no

      no

      no

      Data Backup & Restore

      The Data Backup & Restore role allows data to be backed up and restored, per bucket. The role supports the reading of data. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users.

      The privileges represented in this table are, from left to right, Read, Write, Execute, Manage, Select, Backup, Create, List, and Build.

      Role: Data Backup & Restore (data_backup)
      Resources Privileges
      Rd Wrt Exec Mng Slct Bckp Crt Lst Bld

      Bucket: : Data

      yes

      yes

      no

      no

      no

      no

      no

      no

      no

      Bucket: : Views

      yes

      yes

      no

      no

      no

      no

      no

      no

      no

      Bucket: : FTS

      yes

      yes

      no

      yes

      no

      no

      no

      no

      no

      Bucket: : Stats

      yes

      no

      no

      no

      no

      no

      no

      no

      no

      Bucket: : Settings

      yes

      no

      no

      no

      no

      no

      no

      no

      no

      Bucket: : N1QL, Index

      no

      no

      no

      no

      no

      no

      yes

      yes

      yes

      Bucket: : Analytics

      no

      no

      no

      yes

      no

      no

      no

      no

      no

      Analytics:

      no

      no

      no

      no

      yes

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      no

      no

      no

      no

      no

      Data Monitor

      The Data Monitor role allows statistics to be read, per bucket. It does not allow access to Couchbase Web Console, and does not permit the reading of data. This role is intended to support application-access, rather than user-access.

      In versions of Couchbase Server prior to 5.5, this role was referred to as Data Monitoring.

      Role: Data Monitor (data_monitoring)
      Resources Privileges
      Read Write Execute Manage

      Bucket : Stats

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Views Admin

      The Views Admin role allows the management of views, per bucket. The role allows access to Couchbase Web Console.

      Role: Views Admin (views_admin)
      Resources Privileges
      Read Write Execute Manage

      Bucket Data (Views)

      yes

      yes

      yes

      yes

      Bucket Data (Other)

      yes

      no

      no

      no

      Bucket Settings

      yes

      no

      no

      no

      UI (Views)

      yes

      yes

      yes

      yes

      UI (Other)

      yes

      no

      no

      no

      Views Reader

      The Views Reader role allows data to be read from the views, per bucket. This role does not allow access to Couchbase Web Console, and is intended to support applications, rather than users.

      Role: Views Reader (views_reader)
      Resources Privileges
      Read Write Execute Manage

      Bucket : Docs

      yes

      no

      no

      no

      Bucket : Views

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Query Select

      The Query Select role allows the SELECT statement to be executed, perbucket. This role allows access to Couchbase Web Console, and supports the reading of data.

      Role: Query Select (query_select)
      Resources Privileges
      Read Write Execute Manage

      Bucket : N1QL, SELECT

      yes

      no

      yes

      no

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Query Update

      The Query Update role allows the UPDATE statement to be executed, per bucket. The role supports access to Couchbase Web Console, but does not allow the reading of data.

      Role: Query Update (query_update)
      Resources Privileges
      Read Write Execute Manage

      Bucket : N1QL, UPDATE

      no

      no

      yes

      no

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Query Insert

      The Query Insert role allows the INSERT statement to be executed, per bucket. The role supports access to Couchbase Web Console, but does not allow the reading of data.

      Role: Query Insert (query_insert)
      Resources Privileges
      Read Write Execute Manage

      Bucket : N1QL, INSERT

      no

      no

      yes

      no

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Query Delete

      The Query Delete role allows the DELETE statement to be executed, per bucket. The role supports access to Couchbase Web Console, but does not allow the reading of data.

      Role: Query Delete (query_delete)
      Resources Privileges
      Read Write Execute Manage

      Bucket : N1QL, DELETE

      no

      no

      yes

      no

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Query Manage Index

      The Query Manage Index role allows indexes to be managed, per bucket. The role allows access to Couchbase Web Console, but does not permit the reading of data.

      Role: Query Manage Index (query_manage_index)
      Resources Privileges
      Read Write Execute Manage

      Bucket : N1QL, INDEX

      yes

      yes

      yes

      yes

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Search Admin

      The Search Admin role allows management of all features of the Search Service, per bucket. The role allows access to Couchbase Web Console.

      In versions of Couchbase Server prior to 5.5, this role was referred to as FTS Admin.

      Role: Search Admin (fts_admin)
      Resources Privileges
      Read Write Execute Manage

      Bucket Data (Search)

      yes

      yes

      yes

      yes

      Bucket Data (Other)

      yes

      no

      no

      no

      Bucket Settings

      yes

      no

      no

      no

      UI (Search)

      yes

      yes

      yes

      yes

      UI (Other)

      yes

      no

      no

      no

      Services and Curl

      no

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Search Reader

      The role Search Reader allows Full Text Search indexes to be searched, per bucket. The role allows access to Couchbase Web Console, and supports the reading of data.

      In versions of Couchbase Server prior to 5.5, this role was referred to as FTS Searcher.

      Role: Search Reader (fts_searcher)
      Resources Privileges
      Read Write Execute Manage

      Bucket : FTS

      yes

      no

      no

      no

      Settings: FTS

      yes

      no

      no

      no

      UI

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      Analytics Manager

      The Analytics Manager role allows management of Analytics, per bucket. It also allows management of shadow datasets, provided that Data Read permission has been granted on the corresponding buckets. This role allows access to Couchbase Web Console.

      Role: Analytics Manager (analytics_manager)
      Resources Privileges
      Read Write Execute Manage

      Bucket : Analytics

      no

      no

      no

      yes

      Bucket : UI

      yes

      no

      no

      no

      Bucket : Stats

      yes

      no

      no

      no

      Pools

      yes

      no

      no

      no

      System Keyspaces (Tables)

      The following system keyspaces are provided:

      System Catalogs

      Monitoring Catalogs

      Security Catalogs

      SELECT Operations on System Keyspaces

      All of the system keyspaces support SELECT operations and are divided into the below security levels:

      concepts rba for apps table SELECT