Use this page when a user is locked out or has forgotten their password. You also set a user's query memory limit and revoke their API tokens here. All of these actions sit on the user's page in Admin > Profile Management > Users. Per-user two-factor administration is on its own page: see Two-factor authentication for users.
The temporary password appears only in Copy Password. Copy it before you click Done. If you lose it, reset the password again.
After a reset:
Resynchronize in the row menu opens the Resynchronize & reset dialog. It re-syncs the user's roles and permissions for reporting and, like a reset, issues a fresh temporary password. The dialog says "Permissions will be pushed to the reporting system and credentials will be refreshed." and lists "Re-sync roles and permissions to reporting", "Generate a fresh temporary password" and "Share the new password with the user securely". Confirm with Resynchronize, then copy the password as above.
On your own row, the action reads Change password, or Set up password when your SSO-linked account has no password yet. It opens the same form as your profile: see Your profile and preferences. Setting up a password for an account that already has one is refused with "A password is already set for this account. Use change password instead."
Locked accounts show a Locked chip in the user list and on the user's page. On the page, click Unlock, or use Unlock account under Account, then confirm in the Unlock user? dialog. The dialog explains that this unlocks the account and lets the user log in again. The action appears only while the lock is still in effect, and unlocking needs the Activate User permission.
When it works, the product shows "User unlocked successfully". If there is nothing to unlock, the request is refused with "User is not locked".
An account locks after too many wrong sign-ins in a row. How many, and for how long, is set under Account lockout in the password policy. See Sign-in security.
Open the user and find Memory limit under Account. Pick a preset chip such as 2 GB or 4 GB, or choose Custom to open a slider and set an exact value. The slider label shows the allowed range, from 1 GB to the server's cap. The change saves on its own a moment after you stop moving the slider.
| Setting | What it does | Default |
|---|---|---|
| Memory limit | The most RAM this user's queries can use. The smallest value is 1 GB. The largest is the server's cap, shown in the slider's label; it differs between installations. | 4 GB |
The dialog explains: "Each token acts as this user within its scopes. Deactivating the user stops all of them; revoke one here when a single integration must stop." Each row shows the token's name, its prefix, its scopes, and when it was created and last used. Token values are never readable, not even by administrators, so you can list and revoke tokens but not see them.
Revoking stops that token only. To stop all of a user's tokens, deactivate the user. The Deactivate user action sits under Status.
Users manage their own tokens on API tokens.
| Action | Permission |
|---|---|
| Reset password | Reset Password |
| Unlock account | Activate User |
| Change the memory limit | Modify User Name or Modify User Permissions |
| Revoke another user's API tokens | Manage API Tokens Of Other Users |
Bundles such as Reset User Password or API Token Administrator include these permissions. See the permission reference.
Yes, if an Email channel is active. You also see the password once in Copy Password. If no Email channel is active, no email is sent, and the failure is recorded as "No active email integration configured" in the notification log.
No. All their sessions end, and they sign in again with the temporary password.
Use Resynchronize when the user's roles or permissions should also be pushed to reporting; it does that and issues a fresh temporary password, like a reset. Use Reset password when only the password is the problem.
The user signs in only with SSO and has no platform password ("This account authenticates via SSO and has no password to reset."). If password sign-in is off for the installation, password actions are unavailable for everyone except built-in Admin accounts ("Password login is disabled on this instance; platform passwords cannot be managed."). See Single sign-on (SSO).
You cannot reset your own password from the Users list ("Cannot reset password on your own account."). Your own row opens the self-service form instead, so it reads Change password, or Set up password if your SSO-linked account has no password yet. See Your profile and preferences.
They have failed to sign in too many times. Wait for the lockout to end, or open the user and choose Unlock. See Sign-in security for how the lockout is configured.
Yes. Pick a preset or drag the slider and the change saves by itself a moment later. If saving fails, the control returns to the saved value and shows "Failed to update ClickHouse memory limit".
The save failed, so the control returned to the saved value and the product showed "Failed to update ClickHouse memory limit". Pick the value again; if it keeps failing, check that you can change users.
One protected account has a locked memory limit ("This account's ClickHouse memory settings cannot be changed."). Its limit stays as it is.
Raise their Memory limit. The slider stops at the server's cap, which its label shows.
Open the user, click API tokens, and revoke their tokens. Or deactivate the user, which stops all of their tokens.
No. A token value is shown only once, when it is created, and never to administrators afterwards. You can list tokens and revoke them, but not read them. Revoke a token that should not exist, and ask the user to create a new one.