All Products
Search

This Product

    E-MapReduce:Access control

    Document Center

    E-MapReduce:Access control

    Last Updated:Jun 18, 2026

    Alibaba Cloud E-MapReduce (EMR) provides four types of service parameters to configure a ClickHouse cluster: client, server, access control, and extension. This topic describes the access control parameters for the ClickHouse service.

    Background information

    User access permissions are configured in the server-users and server-metrika files. The configuration includes three sections: users, profiles, and quotas.

    Note

    For more information about the client, server, and extension configurations for the ClickHouse service, see Configuration parameters.

    Prerequisites

    You have created an E-MapReduce ClickHouse cluster. For details, see Create a cluster.

    Users configuration

    You can view or modify configurations in the service configuration area on the ClickHouse service configuration page. The users configuration is on the server-users tab.

    Parameter

    Description

    users.default.networks.host

    The hostnames from which the default user can connect. The default value is empty.

    To specify multiple hostnames, separate them with commas (,).

    users.default.networks.host_regexp

    The regular expressions for hostnames from which the default user can connect. The default value is empty.

    To specify multiple expressions, separate them with commas (,).

    users.default.networks.ip

    The IP addresses from which the default user can connect. The default value is ::/0, which allows access from all IP addresses.

    To specify multiple IP addresses, separate them with commas (,).

    Important

    Ensure that at least one of the users.default.networks.ip, users.default.networks.host, and users.default.networks.host_regexp parameters is set. Otherwise, network connection may fail.

    users.default.profile

    The profile used by the default user. The default value is default.

    users.default.password

    The password for the default user in the ClickHouse server. The default value is empty.

    Important

    We do not recommend this configuration. We recommend that you set a password by adding the custom parameter users.default.password_sha256_hex or users.default.password_double_sha1_hex.

    • users.default.password_sha256_hex: The hexadecimal string of the SHA256 hash.

    • users.default.password_double_sha1_hex: The hexadecimal string of a key generated by a double SHA1 hash.

    users.default.quota

    The quota configuration used by the default user. The default value is default.

    Profiles configuration

    You can view or modify configurations in the Service Configuration section of the ClickHouse service configuration page. The profiles configuration is on the server-users tab.

    Parameter

    Description

    profiles.default.max_memory_usage

    Sets the value of the max_memory_usage parameter in the profile named 'default'. This parameter specifies the maximum memory that a single query can use.

    The default is 10,000,000,000 bytes.

    profiles.default.use_uncompressed_cache

    Sets the value of use_uncompressed_cache in the profile named default.

    • 1 (default): Uses the cache for uncompressed data blocks.

    • 0: Does not use the cache for uncompressed data blocks.

    profiles.default.load_balancing

    Sets the value of load_balancing in the profile named default. This setting specifies the policy for selecting replicas in distributed query processing.

    For more information about the strategies, see Settings.

    profiles.readonly.readonly

    Specifies whether the readonly profile is restricted to read-only operations.

    • 1: Restricts the profile to read-only operations.

    • 0: Does not enable the read-only mode.

    Quotas configuration

    You can view or modify configurations in the service configuration section on the ClickHouse service configuration page. The quotas configuration is on the server-metrika tab.

    quotas_default: ClickHouse uses quotas to apply resource limits. This parameter modifies the settings for the default quota, which is specified by users.default.quota. To add a new quota setting, you can click Custom Configuration in the upper-right corner. For more information, see Add component parameters.