<commit_before>---
title: Fine-grained authorization in InfluxDB Enterprise
alias:
  -/docs/v1.5/administration/fga
menu:
  enterprise_influxdb_1_7:
    name: Fine-grained authorization
    weight: 10
    parent: Guides
---

Fine-grained authorization (FGA) in InfluxDB Enterprise controls access at the database, measurement, and series level.

> **Note:** InfluxDB OSS controls access at the database level only.

## Set up fine-grained authorization

To set up fine-grained authorization (FGA), you must have
[admin permissions](/influxdb/v1.7/administration/authentication_and_authorization/#admin-user-management),
and then complete the following steps.

1. [Enable authentication](/influxdb/v1.7/administration/authentication_and_authorization/#set-up-authentication) in your InfluxDB configuration file.

2. Create users through the InfluxDB query API.

    ```sql
    CREATE USER username WITH PASSWORD 'password'
    ```

    For detail, see [User management commands](/influxdb/v1.7/administration/authentication_and_authorization/#user-management-commands).

3. Obtain access to the **meta** nodes' HTTP API (port 8091 by default).

    > In a typical cluster configuration, the data nodes' HTTP ports
    > (8086 by default) are exposed to clients but the meta nodes' HTTP ports are not.
    > You may need to work with your network administrator to gain access to the meta nodes' HTTP ports.

4. _(Optional)_ [Create roles](#manage-roles). Roles let you grant permissions to groups of users assigned to each role.

    > For an overview of how users and roles work in InfluxDB Enterprise, see [InfluxDB Enterprise users](/enterprise_influxdb/v1.7/features/users/).

5. [Set up restrictions](#manage-restrictions). Restrictions apply to all non-admin users.

    > Permissions (currently "read" and "write") may be restricted independently depending on the scenario.

7. [Set up grants](#manage-grants) to remove restrictions for specified users and roles.

---

{{% note %}}
#### Tools used in examples
The examples below use `curl`, a command line tool for transferring data, to send
HTTP requests to the Meta API, and `jq`, a command line JSON processor,
to make the JSON output easier to read.
Alternatives for each are available, but are not covered in this documentation.
{{% /note %}}

---

## Matching methods
As you manage restrictions and grants to databases, measurements, or seriesusing matching methods.
The following matching methods are available:

- **exact**: Matches only exact string matches.
- **prefix**: Matches strings the begin with a specified prefix.

```sh
# Match a database name exactly
"database": {"match": "exact", "value": "my_database"}

# Match any databases that begin with "my_"
"database": {"match": "prefix", "value": "my_"}
```

{{% note %}}
#### Wildcard matching
Neither `exact` nor `prefix` matching methods allow for wildcard matching.
{{% /note %}}

## Manage roles
Roles allow you to assign permissions to groups of users.
The following examples assume the `user1`, `user2` and `ops` users already exist in InfluxDB.

### Create a role
To create a new role, use the InfluxDB Meta API `/role` endpoint with the `action`<commit_msg>added infomration about fga commands including admin creds<commit_after>---
title: Fine-grained authorization in InfluxDB Enterprise
alias:
  -/docs/v1.5/administration/fga
menu:
  enterprise_influxdb_1_7:
    name: Fine-grained authorization
    weight: 10
    parent: Guides
---

Fine-grained authorization (FGA) in InfluxDB Enterprise controls access at the database, measurement, and series level.

> **Note:** InfluxDB OSS controls access at the database level only.

## Set up fine-grained authorization

To set up fine-grained authorization (FGA), you must have
[admin permissions](/influxdb/v1.7/administration/authentication_and_authorization/#admin-user-management),
and then complete the following steps.

1. [Enable authentication](/influxdb/v1.7/administration/authentication_and_authorization/#set-up-authentication) in your InfluxDB configuration file.

2. Create users through the InfluxDB query API.

    ```sql
    CREATE USER username WITH PASSWORD 'password'
    ```

    For detail, see [User management commands](/influxdb/v1.7/administration/authentication_and_authorization/#user-management-commands).

3. Obtain access to the **meta** nodes' HTTP API (port 8091 by default).

    > In a typical cluster configuration, the data nodes' HTTP ports
    > (8086 by default) are exposed to clients but the meta nodes' HTTP ports are not.
    > You may need to work with your network administrator to gain access to the meta nodes' HTTP ports.

4. _(Optional)_ [Create roles](#manage-roles). Roles let you grant permissions to groups of users assigned to each role.

    > For an overview of how users and roles work in InfluxDB Enterprise, see [InfluxDB Enterprise users](/enterprise_influxdb/v1.7/features/users/).

5. [Set up restrictions](#manage-restrictions). Restrictions apply to all non-admin users.

    > Permissions (currently "read" and "write") may be restricted independently depending on the scenario.

7. [Set up grants](#manage-grants) to remove restrictions for specified users and roles.

---

{{% note %}}
#### Notes about examples
The examples below use `curl`, a command line tool for transferring data, to send
HTTP requests to the Meta API, and `jq`, a command line JSON processor,
to make the JSON output easier to read.
Alternatives for each are available, but are not covered in this documentation.

All examples  assume authentication is enabled in InfluxDB and require admin
credentials with each request.
Use the `curl -u` flag to pass authentication credentials:

```sh
curl -u `username:password` #...
```
{{% /note %}}

---

## Matching methods
As you manage restrictions and grants to databases, measurements, or seriesusing matching methods.
The following matching methods are available:

- **exact**: Matches only exact string matches.
- **prefix**: Matches strings the begin with a specified prefix.

```sh
# Match a database name exactly
"database": {"match": "exact", "value": "my_database"}

# Match any databases that begin with "my_"
"database": {"match": "prefix", "value": "my_"}
```

{{% note %}}
#### Wildcard matching
Neither `exact` nor `prefix` matching methods allow for wildcard matching.
{{% /note %}}

## Manage roles
Roles allow you to assign permissions to groups of users.
The following examples assume the `user1`, `user2` and `ops` users already exist in InfluxDB.

### Create a role
To create a new role, use the InfluxDB Meta API `/role` endpoint with the `action`
{'fraction_non_alphanumeric': 0.09576232845724626, 'fraction_numerical': 0.009048408988086261, 'mean_word_length': 4.462932454695222, 'pattern_counts': {'":': 12, '<': 3, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1793551', 'n_tokens_mistral': 1887, 'n_tokens_neox': 1777, 'n_words': 807}