Passwords, locks and limits for a user

Use this page when a user is locked out or has forgotten their password. You also set a user's query memory limit and revoke their API tokens here. All of these actions sit on the user's page in Admin > Profile Management > Users. Per-user two-factor administration is on its own page: see Two-factor authentication for users.

Open a user's actions

1. Click Admin in the sidebar.
2. Select Profile Management, then Users.
3. Click the user's row to open their page. The action rows are grouped under three headings: Access, Account and Status. The password actions, Unlock account and Memory limit sit under Account.
4. Or right-click the row and choose Reset Password or Resynchronize from the row menu.

• Destructive rows such as Delete user appear in red.
• A row that holds a control, such as Memory limit, does not open anything when you click elsewhere on the row; use the control itself.
• Actions your permissions do not allow are left out, and a disabled action keeps its reason in a tooltip.

Reset a forgotten password

1. Open the user and click Reset password under Account. Or right-click the row and choose Reset Password.
2. In the Reset password? dialog, click Reset password. The dialog explains: "A new temporary password will be generated. The current password will be invalidated immediately."
3. In Copy Password, the password is masked. Use the eye icon to show it, then click Click to copy password; the bar reads Password copied! for two seconds. Pass the password to the user through a secure channel, and click Done.

After a reset:

• The user is signed out everywhere: every session ends.
• Any lockout on the account is cleared.
• The user must choose a new password at their next sign-in.
• Their database tool access is re-synced to the new password.
• The new password always meets your password policy.
• If an Email channel is active, the user is emailed the reset. If none is active, no email is sent, and the failed send is recorded as "No active email integration configured" in the notification log.

Resynchronize a user's access

Resynchronize in the row menu opens the Resynchronize & reset dialog. It re-syncs the user's roles and permissions for reporting and, like a reset, issues a fresh temporary password. The dialog says "Permissions will be pushed to the reporting system and credentials will be refreshed." and lists "Re-sync roles and permissions to reporting", "Generate a fresh temporary password" and "Share the new password with the user securely". Confirm with Resynchronize, then copy the password as above.

Set your own password

On your own row, the action reads Change password, or Set up password when your account has no password yet, because it is SSO-linked or DataMind Platform sign-in created it. It opens the same form as your profile: see Your profile and preferences. Setting up a password for an account that already has one is refused with "A password is already set for this account. Use change password instead."

Unlock a locked account

Locked accounts show a Locked chip in the user list and on the user's page. On the page, click Unlock, or use Unlock account under Account, then confirm in the Unlock user? dialog. The dialog explains that this unlocks the account and lets the user log in again. The action appears only while the lock is still in effect, and unlocking needs the Activate Users permission.

When it works, the product shows "User unlocked successfully". If there is nothing to unlock, the request is refused with "User is not locked".

An account locks after too many wrong sign-ins in a row. How many, and for how long, is set under Account lockout in the password policy. See Sign-in security.

Set the query memory limit

Open the user and find Memory limit under Account. Pick a preset chip such as 2 GB or 4 GB, or choose Custom to open a slider and set an exact value. The slider label shows the allowed range, from 1 GB to the server's cap. The change saves on its own a moment after you stop moving the slider.

• The presets are the same for every account, because they are derived from the server's cap, not from the account's saved value.
• If saving fails, the control returns to the saved value and shows "Failed to update ClickHouse memory limit".
• The limit applies to the user's account, so it also applies when they connect from an external SQL tool. See Connection settings.

DataMind Platform connection

A user who signs in with DataMind Platform has a DataMind Platform row under Account. It reads Connected. Created by DataMind Platform sign-in. for an account that DataMind Platform sign-in created, Connected. Signs in with a DataMind Platform account. for an account its owner connected, and Created by DataMind Platform sign-in. Not connected any more. once a created account has lost its connection. Other users have no such row.

To remove the connection, click Disconnect on the row, then Disconnect in Disconnect DataMind Platform. The account, its roles and its data stay as they are, and DataMind OS shows "DataMind Platform has been disconnected." The user signs in with a password from then on, and can connect again from their profile. See Sign in with DataMind Platform.

An account that DataMind Platform sign-in created has no password. The dialog then warns "This account has no password, so its owner cannot sign in until a password is set." Give the user a password with Reset password before or after you disconnect.

Revoke a user's API tokens

1. Open the user and click API tokens under Access. The action appears only if you can manage other users' tokens.
2. In the dialog titled API tokens of followed by the user's name, find the token and click its revoke icon, then click Revoke in the inline confirmation. Keep leaves the token alone.

The dialog explains: "Each token acts as this user within its scopes. Deactivating the user stops all of them; revoke one here when a single integration must stop." Each row shows the token's name, its prefix, its scopes, and when it was created and last used. Token values are never readable, not even by administrators, so you can list and revoke tokens but not see them.

Revoking stops that token only. To stop all of a user's tokens, deactivate the user. The Deactivate user action sits under Status.

Users manage their own tokens on API tokens.

Permissions

Bundles such as Reset User Password or API Token Administrator include these permissions. See the permission reference.

Limits and edge cases

• You cannot reset your own password from the Users list ("Cannot reset password on your own account."). Change your own password in Your profile and preferences.
• An SSO-only account has no password to reset ("This account authenticates via SSO and has no password to reset.").
• When password sign-in is off, password actions are unavailable and the product reports "Password login is disabled on this instance; platform passwords cannot be managed." Only built-in Admin accounts keep a password action.
• An account that DataMind Platform sign-in created has no password until one is set, and Reset password gives it a temporary one like any other account.
• If you cannot change users, the memory limit is read-only: "You do not have permission to change the memory limit."
• A password reset also clears a lockout, so a locked user can sign in with the new password without a separate unlock.
• A reset does not change the user's roles or permissions. Use Resynchronize when those should also be pushed to reporting.

Questions, answered

Does the user get the new password by email?

Yes, if an Email channel is active. You also see the password once in Copy Password. If no Email channel is active, no email is sent, and the failure is recorded as "No active email integration configured" in the notification log.

Will the user stay signed in after I reset their password?

No. All their sessions end, and they sign in again with the temporary password.

When should I use Resynchronize instead of Reset password?

Use Resynchronize when the user's roles or permissions should also be pushed to reporting; it does that and issues a fresh temporary password, like a reset. Use Reset password when only the password is the problem.

Why is there no Reset password for this user?

The user signs in only with SSO and has no platform password ("This account authenticates via SSO and has no password to reset."). If password sign-in is off for the installation, password actions are unavailable for everyone except built-in Admin accounts ("Password login is disabled on this instance; platform passwords cannot be managed."). See Single sign-on (SSO).

Why does my own account show Change password instead of Reset password?

You cannot reset your own password from the Users list ("Cannot reset password on your own account."). Your own row opens the self-service form instead, so it reads Change password, or Set up password if your account has no password yet. See Your profile and preferences.

A user says their account is locked. What do I do?

They have failed to sign in too many times. Wait for the lockout to end, or open the user and choose Unlock. See Sign-in security for how the lockout is configured.

Does the memory limit save on its own?

Yes. Pick a preset or drag the slider and the change saves by itself a moment later. If saving fails, the control returns to the saved value and shows "Failed to update ClickHouse memory limit".

Why did the memory limit jump back after I set it?

The save failed, so the control returned to the saved value and the product showed "Failed to update ClickHouse memory limit". Pick the value again; if it keeps failing, check that you can change users.

A user's large query runs out of memory. What should I change?

Raise their Memory limit. The slider stops at the server's cap, which its label shows.

An employee has left. How do I stop their scripts using API tokens?

Open the user, click API tokens, and revoke their tokens. Or deactivate the user, which stops all of their tokens.

Can I see the value of a user's API token?

No. A token value is shown only once, when it is created, and never to administrators afterwards. You can list tokens and revoke them, but not read them. Revoke a token that should not exist, and ask the user to create a new one.

Can I remove a user's DataMind Platform connection?

Yes. On the user's page, click Disconnect on the DataMind Platform row under Account. The account keeps its roles and data; if it has no password, give it one with Reset password so the user can still sign in.