[Yandex Cloud documentation](../../index.md) > [Yandex MPP Analytics for PostgreSQL](../index.md) > [Step-by-step guides](index.md) > Users and sessions > User authentication rules

# User authentication rules

[User authentication](../concepts/user-authentication.md) rules determine which users from which addresses are allowed to connect to a cluster, as well as which databases they can access.

You can:

* [Get a list of rules](#list-rules).
* [Add a rule](#add-rules).
* [Edit a rule](#edit-rules).
* [Change the rule priority](#replace-rule).
* [Delete a rule](#delete-rule).

{% note warning %}

The rule priority matches the order of rows: rules are read from top to bottom, and the first relevant rule applies. If authentication based on the first suitable rule fails, other rules do not apply.

{% endnote %}

## Getting a list of rules {#list-rules}

{% list tabs group=instructions %}

- Management console {#console}

    1. Open the [folder dashboard](https://console.yandex.cloud).
    1. Navigate to **Yandex MPP Analytics for PostgreSQL**.
    1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **User authentication** tab.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. View the description of the command for getting a list of rules:

        ```bash
        yc managed-greenplum hba-rules list --help
        ```

    1. Get a list of rules:

        ```bash
        yc managed-greenplum hba-rules list --cluster-id <cluster_ID>
        ```

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

        Result:

        ```bash
        +----------+-----------------+-----+-------+-------------------------------------------+-------------+
        | PRIORITY | CONNECTION TYPE | DB  | USER  |                  ADDRESS                  | AUTH METHOD |
        +----------+-----------------+-----+-------+-------------------------------------------+-------------+
        |        1 | HOST            | db1 | user1 | rc1a-no8u9mlr********.mdb.yandexcloud.net | MD5         |
        +----------+-----------------+-----+-------+-------------------------------------------+-------------+
        ```

- REST API {#api}   

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Call the [HBARule.List](../api-ref/HBARule/list.md) method, e.g., via the following [cURL](https://curl.se/) request:

        ```bash
        curl \
            --request GET \
            --header "Authorization: Bearer $IAM_TOKEN" \
            --header "Content-Type: application/json" \
            --url 'https://mdb.api.cloud.yandex.net/managed-greenplum/v1/clusters/<cluster_ID>/hbaRules'
        ```

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

    1. View the [server response](../api-ref/HBARule/list.md#yandex.cloud.mdb.greenplum.v1.ListHBARulesResponse) to make sure your request was successful.

- gRPC API {#grpc-api}

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
       
       ```bash
       cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
       ```
       
       Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

    1. Call the [HBARuleService.List](../api-ref/grpc/HBARule/list.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

        ```bash
        grpcurl \
            -format json \
            -import-path ~/cloudapi/ \
            -import-path ~/cloudapi/third_party/googleapis/ \
            -proto ~/cloudapi/yandex/cloud/mdb/greenplum/v1/hba_rule_service.proto \
            -rpc-header "Authorization: Bearer $IAM_TOKEN" \
            -d '{
                    "cluster_id": "<cluster_ID>"
                }' \
            mdb.api.cloud.yandex.net:443 \
            yandex.cloud.mdb.greenplum.v1.HBARuleService.List
        ```

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

    1. View the [server response](../api-ref/grpc/HBARule/list.md#yandex.cloud.mdb.greenplum.v1.ListHBARulesResponse) to make sure your request was successful.

{% endlist %}          

## Adding a rule {#add-rules}

{% list tabs group=instructions %}

- Management console {#console}

    1. Open the [folder dashboard](https://console.yandex.cloud).
    1. Navigate to **Yandex MPP Analytics&nbsp;for&nbsp;PostgreSQL**.
    1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **User authentication** tab.
    1. Click **Edit rules**.
    1. Click ![image](../../_assets/console-icons/plus.svg) **Add rule** and specify its settings:

        * **Type**: Interconnect type.
        * **Database**: Name of the database to connect to. You cannot specify system databases.
        * **User**: Name of the database user or user group. You cannot specify system users.
        * **Address (CIDR/FQDN)**: Host FQDN or IP range in CIDR notation to connect to the database from.
        * **Method**: Authentication method.
        
        For more information, see [Authentication rule settings](../concepts/user-authentication.md#auth-settings).

    1. To add another rule, click ![image](../../_assets/console-icons/plus.svg) **Add rule**.
    1. Click **Save**.

    {% note info %}

    The default rule is added automatically at the end of the list; it allows authentication for all users in all databases and from all hosts using the `md5` method (password-based authentication).

    {% endnote %}

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. View the description of the add rule command:

        ```bash
        yc managed-greenplum hba-rules create --help
        ```

    1. Add the rule:

        ```bash
        yc managed-greenplum hba-rules create <rule_priority> \
            --cluster-id <cluster_ID> \
            --conn-type <interconnect_type> \
            --database <DB_name> \
            --user <username> \
            --address <address> \
            --auth-method <authentication_method>
        ```

        Where:

        * `conn-type`: Interconnect type. The possible values are `host`, `hostssl`, and `hostnossl`.
        * `address`: Host FQDN or IP range in CIDR notation to connect to the database from.
        * `auth-method`: Authentication method. It can be either `md5` or `reject`.

        For more information, see [Authentication rule settings](../concepts/user-authentication.md#auth-settings).

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

- REST API {#api}   

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Call the [HBARule.Create](../api-ref/HBARule/create.md) method, e.g., via the following [cURL](https://curl.se/) request:

        ```bash
        curl \
            --request POST \
            --header "Authorization: Bearer $IAM_TOKEN" \
            --header "Content-Type: application/json" \
            --url 'https://mdb.api.cloud.yandex.net/managed-greenplum/v1/clusters/<cluster_ID>/hbaRules' \
            --data '{
                        "hbaRule": {
                            "priority": "<rule_priority>",
                            "connectionType": "<interconnect_type>",
                            "database": "<DB_name>",
                            "user": "<username>",
                            "address": "<address>",
                            "authMethod": "<authentication_method>"
                        }
                    }'
        ```

        Where:

        * `connectionType`: Interconnect type. The possible values are `HOST`, `HOSTSSL`, and `HOSTNOSSL`.
        * `address`: Host FQDN or IP range in CIDR notation to connect to the database from.
        * `authMethod`: Authentication method. It can be either `MD5` or `REJECT`.

        For more information, see [Authentication rule settings](../concepts/user-authentication.md#auth-settings).

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

    1. View the [server response](../api-ref/HBARule/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
       
       ```bash
       cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
       ```
       
       Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

    1. Call the [HBARuleService.Create](../api-ref/grpc/HBARule/create.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

        ```bash
        grpcurl \
            -format json \
            -import-path ~/cloudapi/ \
            -import-path ~/cloudapi/third_party/googleapis/ \
            -proto ~/cloudapi/yandex/cloud/mdb/greenplum/v1/hba_rule_service.proto \
            -rpc-header "Authorization: Bearer $IAM_TOKEN" \
            -d '{
                    "cluster_id": "<cluster_ID>",
                    "hba_rule": {
                        "priority": "<rule_priority>",
                        "connection_type": "<interconnect_type>",
                        "database": "<DB_name>",
                        "user": "<username>",
                        "address": "<address>",
                        "auth_method": "<authentication_method>"
                    }
                }' \
            mdb.api.cloud.yandex.net:443 \
            yandex.cloud.mdb.greenplum.v1.HBARuleService.Create
        ```

        Where:

        * `connection_type`: Interconnect type. The possible values are `HOST`, `HOSTSSL`, and `HOSTNOSSL`.
        * `address`: Host FQDN or IP range in CIDR notation to connect to the database from.
        * `auth_method`: Authentication method. It can be either `MD5` or `REJECT`.

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

    1. View the [server response](../api-ref/grpc/HBARule/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Editing a rule {#edit-rules}

{% list tabs group=instructions %}

- Management console {#console}

    1. Open the [folder dashboard](https://console.yandex.cloud).
    1. Navigate to **Yandex MPP Analytics&nbsp;for&nbsp;PostgreSQL**.
    1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **User authentication** tab.
    1. Click **Edit rules** and update the rule settings:

        * **Type**: Interconnect type.
        * **Database**: Name of the database to connect to. You cannot specify system databases.
        * **User**: Name of the database user or user group. You cannot specify system users.
        * **Address (CIDR/FQDN)**: Host FQDN or IP range in CIDR notation to connect to the database from.
        * **Method**: Authentication method.
        
        For more information, see [Authentication rule settings](../concepts/user-authentication.md#auth-settings).

    1. Click **Save**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. View the description of the update rule command:

        ```bash
        yc managed-greenplum hba-rules update --help
        ```

    1. Update the rule:

        ```bash
        yc managed-greenplum hba-rules update <rule_priority> \
            --cluster-id <cluster_ID> \
            --conn-type <interconnect_type> \
            --database <DB_name> \
            --user <username> \
            --address <address> \
            --auth-method <authentication_method>
        ```

        Where:

        * `conn-type`: Interconnect type. The possible values are `host`, `hostssl`, and `hostnossl`.
        * `address`: Host FQDN or IP range in CIDR notation to connect to the database from.
        * `auth-method`: Authentication method. It can be either `md5` or `reject`.

        For more information, see [Authentication rule settings](../concepts/user-authentication.md#auth-settings).

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

        You can find out the rule priority by [requesting a list of all rules in the cluster](#list-rules).

- REST API {#api}   

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Call the [HBARule.Update](../api-ref/HBARule/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

        ```bash
        curl \
            --request PATCH \
            --header "Authorization: Bearer $IAM_TOKEN" \
            --header "Content-Type: application/json" \
            --url 'https://mdb.api.cloud.yandex.net/managed-greenplum/v1/clusters/<cluster_ID>/hbaRules' \
            --data '{
                        "hbaRule": {
                            "priority": "<rule_priority>",
                            "connectionType": "<interconnect_type>",
                            "database": "<DB_name>",
                            "user": "<username>",
                            "address": "<address>",
                            "authMethod": "<authentication_method>"
                        }
                    }'
        ```

        Where:

        * `connectionType`: Interconnect type. The possible values are `HOST`, `HOSTSSL`, and `HOSTNOSSL`.
        * `address`: Host FQDN or IP range in CIDR notation to connect to the database from.
        * `authMethod`: Authentication method. It can be either `MD5` or `REJECT`.

        For more information, see [Authentication rule settings](../concepts/user-authentication.md#auth-settings).

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

        You can find out the rule priority by [requesting a list of all rules in the cluster](#list-rules).

    1. View the [server response](../api-ref/HBARule/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
       
       ```bash
       cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
       ```
       
       Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

    1. Call the [HBARuleService.Update](../api-ref/grpc/HBARule/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

        ```bash
        grpcurl \
            -format json \
            -import-path ~/cloudapi/ \
            -import-path ~/cloudapi/third_party/googleapis/ \
            -proto ~/cloudapi/yandex/cloud/mdb/greenplum/v1/hba_rule_service.proto \
            -rpc-header "Authorization: Bearer $IAM_TOKEN" \
            -d '{
                    "cluster_id": "<cluster_ID>",
                    "hba_rule": {
                        "priority": "<rule_priority>",
                        "connection_type": "<interconnect_type>",
                        "database": "<DB_name>",
                        "user": "<username>",
                        "address": "<address>",
                        "auth_method": "<authentication_method>"
                    }
                }' \
            mdb.api.cloud.yandex.net:443 \
            yandex.cloud.mdb.greenplum.v1.HBARuleService.Update
        ```

        Where:

        * `connection_type`: Interconnect type. The possible values are `HOST`, `HOSTSSL`, and `HOSTNOSSL`.
        * `address`: Host FQDN or IP range in CIDR notation to connect to the database from.
        * `auth_method`: Authentication method. It can be either `MD5` or `REJECT`.

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

        You can find out the rule priority by [requesting a list of all rules in the cluster](#list-rules).

    1. View the [server response](../api-ref/grpc/HBARule/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.    

{% endlist %}

## Change the rule priority {#replace-rule}

{% list tabs group=instructions %}

- Management console {#console}

    1. Open the [folder dashboard](https://console.yandex.cloud).
    1. Navigate to **Yandex MPP Analytics&nbsp;for&nbsp;PostgreSQL**.
    1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **User authentication** tab.
    1. Click **Edit rules**.
    1. Click ![image](../../_assets/console-icons/grip.svg) for your rule and move it up or down.
    1. Click **Save**.

{% endlist %}

## Deleting a rule {#delete-rule}

{% list tabs group=instructions %}

- Management console {#console}

    1. Open the [folder dashboard](https://console.yandex.cloud).
    1. Navigate to **Yandex MPP Analytics&nbsp;for&nbsp;PostgreSQL**.
    1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **User authentication** tab.
    1. Click **Edit rules**.
    1. Click ![image](../../_assets/console-icons/ellipsis.svg) for your rule and select **Delete**.
    1. Click **Save**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. View the description of the command for deleting a rule:

        ```bash
        yc managed-greenplum hba-rules delete --help
        ```

    1. Delete the rule:

       ```bash
        yc managed-greenplum hba-rules delete <rule_priority> \
            --cluster-id <cluster_ID>
        ```    

    You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

    You can find out the rule priority by [requesting a list of all rules in the cluster](#list-rules).

- REST API {#api}   

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Call the [HBARule.Delete](../api-ref/HBARule/delete.md) method, e.g., via the following [cURL](https://curl.se/) request:

        ```bash
        curl \
            --request DELETE \
            --header "Authorization: Bearer $IAM_TOKEN" \
            --header "Content-Type: application/json" \
            --url 'https://mdb.api.cloud.yandex.net/managed-greenplum/v1/clusters/<cluster_ID>/hbaRule/<rule_priority>'
        ```

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

        You can find out the rule priority by [requesting a list of all rules in the cluster](#list-rules).

    1. View the [server response](../api-ref/grpc/HBARule/delete.md#yandex.cloud.operation.Operation) to make sure your request was successful. 

- gRPC API {#grpc-api}

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
       
       ```bash
       cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
       ```
       
       Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

    1. Call the [HBARuleService.Delete](../api-ref/grpc/HBARule/delete.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

        ```bash
        grpcurl \
            -format json \
            -import-path ~/cloudapi/ \
            -import-path ~/cloudapi/third_party/googleapis/ \
            -proto ~/cloudapi/yandex/cloud/mdb/greenplum/v1/hba_rule_service.proto \
            -rpc-header "Authorization: Bearer $IAM_TOKEN" \
            -d '{
                    "cluster_id": "<cluster_ID>",
                    "priority": "<rule_priority>"
                }' \
            mdb.api.cloud.yandex.net:443 \
            yandex.cloud.mdb.greenplum.v1.HBARuleService.Delete
        ```

        You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

        You can find out the rule priority by [requesting a list of all rules in the cluster](#list-rules).

    1. View the [server response](../api-ref/grpc/HBARule/delete.md#yandex.cloud.operation.Operation) to make sure your request was successful.      

{% endlist %}