GRANT

The GRANT statement allows granting any RBAC roles to a specific user.

Roles can be of the following two types:

simple: Roles which apply generically to all keyspaces or resources in the cluster.

For example: cluster_admin or bucket_admin
parameterized by a keyspace: Roles which are defined for the scope of the specified keyspace only. The keyspace name is specified after ON.

For example: data_reader ON `travel-sample`
or query_select ON `travel-sample`

Only Full Administrators can run the GRANT statement. For more details about user roles, see Authorization.

Syntax

grant ::= 'GRANT' role ( ',' role )* ( 'ON' keyspace-ref ( ',' keyspace-ref )* )?
          'TO' user ( ',' user )*

role

One of the RBAC role names predefined by Couchbase Server.

The following roles have short forms that can be used as well:

user

A user name created by the Couchbase Server RBAC system.

keyspace-ref ::= keyspace-path | keyspace-partial

keyspace-path ::= ( namespace ':' )? bucket ( '.' scope '.' collection )?

keyspace-partial ::= collection

The simple name or fully-qualified name of a keyspace. Refer to the CREATE INDEX statement for details of the syntax.

GRANT statements have two forms:

1. Unparameterized Roles

GRANT replication_admin, query_external_access
   TO cchaplan, jgleason;

2. Parameterized Roles

GRANT query_select, views_admin
   ON orders, customers
   TO bill, linda;

Mixing of parameterized and unparameterized roles or syntax is not allowed and will create an error.

Example 1. Grant the role of Cluster Admin to three people

GRANT cluster_admin TO david, michael, robin;

Example 2. Grant the roles of Cluster Admin and Data Reader in the travel-sample keyspace to Debby

GRANT query_select, query_update ON `travel-sample` TO debby;