================================
Creating a Superuser
================================

There is no default superuser role in ScyllaDB.
Users with a superuser role have full access to the database and can run 
any CQL command on the database resources.

There are two ways you can create a superuser in ScyllaDB:

- :ref:`Using the ScyllaDB Maintenance Socket to create a superuser role <create-superuser-using-maintenance-socket>`
- :ref:`Using an existing superuser account to create a new superuser role <create-superuser-using-existing-superuser>`

When setting up a new cluster, use the maintenance socket approach to create the first superuser.


.. _create-superuser-using-maintenance-socket:

Setting Up a Superuser Using the Maintenance Socket
------------------------------------------------------

If no superuser account exists in the cluster, which is the case for new clusters, you can create a superuser using the ScyllaDB Maintenance Socket.
In order to do that, the node must have the maintenance socket enabled.
See :doc:`Admin Tools: Maintenance Socket </operating-scylla/admin-tools/maintenance-socket/>`.

To create a superuser using the maintenance socket, you should:

1. Connect to the node using ``cqlsh`` over the maintenance socket.

.. code-block:: shell

   cqlsh <maintenance_socket_path>

Replace ``<maintenance_socket_path>`` with the socket path configured in ``scylla.yaml``.

2. Create new superuser role using ``CREATE ROLE`` command.

.. code-block:: cql

   CREATE ROLE <new_superuser>  WITH SUPERUSER = true AND LOGIN = true and PASSWORD = '<new_superuser_password>';

3. Verify that you can log in to your node using ``cqlsh`` command with the new password.

.. code-block:: shell

   cqlsh -u <new_superuser>
   Password: 

.. note::

   Enter the value of `<new_superuser_password>` password when prompted. The input is not displayed.

4. Show all the roles to verify that the new superuser was created:

.. code-block:: cql

   LIST ROLES;


.. _create-superuser-using-existing-superuser:

Setting Up a Superuser Using an Existing Superuser Account
-------------------------------------------------------------

To create a superuser using an existing superuser account, you should:

1. Log in to cqlsh using an existing superuser account.

.. code-block:: shell

   cqlsh -u <existing_superuser>
   Password: 

.. note::

   Enter the value of `<existing_superuser_password>` password when prompted. The input is not displayed.

2. Create a new superuser.

.. code-block:: cql

   CREATE ROLE <new_superuser>  WITH SUPERUSER = true AND LOGIN = true and PASSWORD = '<new_superuser_password>';

3. Verify that you can log in to your node using ``cqlsh`` command with the new password.

.. code-block:: shell

   cqlsh -u <new_superuser>
   Password: 

.. note::

   Enter the value of `<new_superuser_password>` password when prompted. The input is not displayed.

4. Show all the roles to verify that the new superuser was created:

.. code-block:: cql

   LIST ROLES;

