Roles & Privileges

GalaxDB authenticates wire-protocol connections with SCRAM-SHA-256 and enforces table-level access control with standard SQL GRANT / REVOKE statements. Every authentication, authorization, DDL, and admin event is written to a JSONL security audit log.

Enabling Authentication

Authentication is off by default (trusted-local mode) and logs a loud startup warning. Enable it with --auth (or GALAXDB_AUTH=1). The initial superuser is provisioned from environment variables on first start - no default password ships.

bash

GALAXDB_AUTH=1 \
GALAXDB_INITIAL_SUPERUSER=admin \
GALAXDB_INITIAL_SUPERUSER_PASSWORD=change-me-before-production \
galaxdb-server --data-dir /var/lib/galaxdb

Warning

With tls_mode=require, plaintext connections are rejected and SCRAM runs inside the TLS channel. Without --auth, the server runs in trusted-local mode - anyone who can reach the port can connect as any user.

CREATE / ALTER / DROP ROLE

SQL

CREATE ROLE analyst WITH PASSWORD 'a-strong-password' LOGIN;
ALTER ROLE analyst WITH PASSWORD 'a-new-password';
DROP ROLE analyst;

GRANT / REVOKE

Grant and revoke table-level privileges:

SQL

-- Allow analyst to read the docs table
GRANT SELECT ON docs TO analyst;

-- Allow analyst to also write
GRANT SELECT, INSERT, UPDATE, DELETE ON docs TO analyst;

-- Revoke write access again
REVOKE INSERT, UPDATE, DELETE ON docs FROM analyst;

An unprivileged role that attempts an operation it wasn't granted is denied with SQLSTATE 42501:

Python

import galaxdb

conn = galaxdb.connect("host=localhost port=5433 dbname=galaxdb user=analyst sslmode=require")

try:
    conn.execute("INSERT INTO docs (id, body) VALUES (1, 'not allowed')")
except RuntimeError as e:
    print(e)  # SQLSTATE 42501: insufficient privilege

Audit Log

Every authentication attempt, authorization decision, DDL statement, and admin action is written to a JSONL audit log - one JSON object per line, suitable for shipping to a log aggregator.

JSON

{"timestamp":"2026-07-04T10:15:03Z","event":"auth_success","user":"analyst","method":"scram-sha-256"}
{"timestamp":"2026-07-04T10:15:04Z","event":"authz_denied","user":"analyst","action":"INSERT","table":"docs","sqlstate":"42501"}
{"timestamp":"2026-07-04T10:16:00Z","event":"grant","actor":"admin","privilege":"SELECT","table":"docs","grantee":"analyst"}

Version Tags

BACKUP & RESTORE