Users can log into DataHub in 3 ways:
- Invite users via the UI
- Static credentials
- Single Sign-On via OpenID Connect (For Production Use)
which can be enabled simultaneously. Options 1 and 2 are useful for running proof-of-concept exercises, or just getting DataHub up & running quickly. Option 3 is highly recommended for deploying DataHub in production.
Send prospective users an invite link
With the right permissions (
MANAGE_USER_CREDENTIALS), you can invite new users to your deployed DataHub instance from the UI. It's as simple as sending a link!
First navigate, to the Users and Groups tab (under Access) on the Settings page. You'll then see an
Invite Users button. Note that this will only be clickable
if you have the correct permissions.
If you click on this button, you'll see a pop-up where you can copy an invite link to send to users, or generate a fresh one.
When a new user visits the link, they will be directed to a sign up screen. Note that if a new link has since been regenerated, the new user won't be able to sign up!
Reset password for native users
If a user forgets their password, an admin user with the
MANAGE_USER_CREDENTIALS privilege can go to the Users and Groups tab and click on the respective user's
Reset user password button.
Similar to the invite link, you can generate a new reset link and send a link to that user which they can use to reset their credentials.
When that user visits the link, they will be direct to a screen where they can reset their credentials. If the link is older than 24 hours or another link has since been generated, they won't be able to reset their credentials!
Create a user.props file
To define a set of username / password combinations that should be allowed to log in to DataHub, create a new file called
user.props at the file path
This file should contain username:password combinations, with 1 user per line. For example, to create 2 new users,
with usernames "janesmith" and "johndoe", we would define the following file:
Once you've saved the file, simply start the DataHub containers & navigate to
to verify that your new credentials work.
To change or remove existing login credentials, edit and save the
user.props file. Then restart DataHub containers.
If you want to customize the location of the
user.props file, or if you're deploying DataHub via Helm, proceed to Step 2.
(Advanced) Mount custom user.props file to container
This step is only required when mounting custom credentials into a Kubernetes pod (e.g. Helm) or if you want to change
the default filesystem location from which DataHub mounts a custom
user.props file (
If you are deploying with
datahub docker quickstart, or running using Docker Compose, you can most likely skip this step.
You'll need to modify the
docker-compose.yml file to mount a container volume mapping your custom user.props to the standard location inside the container
For example, to mount a user.props file that is stored on my local filesystem at
/tmp/datahub/user.props, we'd modify the YAML for the
datahub-web-react config to look like the following:
# The new stuff
Once you've made this change, restarting DataHub enable authentication for the configured users.
You'll need to create a Kubernetes secret, then mount the file as a volume to the
First, create a secret from your local
kubectl create secret generic datahub-users-secret --from-file=user.props=./<path-to-your-user.props>
Then, configure your
values.yaml to add the volume to the
- name: datahub-users
- name: datahub-users
Note that if you update the secret you will need to restart the
datahub-frontend pods so the changes are reflected. To update the secret in-place you can run something like this.
kubectl create secret generic datahub-users-secret --from-file=user.props=./<path-to-your-user.props> -o yaml --dry-run=client | kubectl apply -f -
URNs are identifiers that uniquely identify an Entity on DataHub. The usernames defined in the
user.props file will be used to generate the DataHub user "urn", which uniquely identifies
the user on DataHub. The urn is computed as:
Adding User Details
If you add a new username / password to the
user.props file, no other information about the user will exist
about the user in DataHub (full name, email, bio, etc). This means that you will not be able to search to find the user.
In order for the user to become searchable, simply navigate to the new user's profile page (top-right corner) and click Edit Profile. Add some details like a display name, an email, and more. Then click Save. Now you should be able to find the user via search.
You can also use our Python Emitter SDK to produce custom information about the new user via the CorpUser metadata entity.
For a more comprehensive overview of how users & groups are managed within DataHub, check out this video.
Changing the default 'datahub' user
The 'datahub' admin user is created for you by default. There is no way to override the default password for this account following the steps outlined above to add a custom user.props file. This is due to the way the authentication setup is working - we support a "default" user.props containing the root datahub user and a separate custom file, which does not overwrite the first.
However, it's still possible to change the password for the default
datahub user. To change it, follow these steps:
- Update the
docker-compose.yamlto mount your default user.props file to the following location inside the
datahub-frontend-reactcontainer using a volume:
- Restart the datahub containers to pick up the new configs
If you're deploying using the CLI quickstart, you can simply download a copy of the docker-compose file used in quickstart,
and modify the
datahub-frontend-react block to contain the extra volume mount. Then simply run
datahub docker quickstart —quickstart-compose-file <your-modified-compose>.yml
Setting up SSO via OpenID Connect means that users will be able to login to DataHub via a central Identity Provider such as
- Azure AD
- Google Identity
This option is recommended for production deployments of DataHub. For detailed information about configuring DataHub to use OIDC to perform authentication, check out OIDC Authentication.
URNs are identifiers that uniquely identify an Entity on DataHub. The username received from an Identity Provider when a user logs into DataHub via OIDC is used to construct a unique identifier for the user on DataHub. The urn is computed as:
For information about configuring which OIDC claim should be used as the username for Datahub, check out the OIDC Authentication doc.
- Can I enable OIDC and username / password (JaaS) authentication at the same time?
YES! If you have not explicitly disabled JaaS via an environment variable on the datahub-frontend container (AUTHJAAS_ENABLED),
then you can _always access the standard login flow at
Feedback / Questions / Concerns
We want to hear from you! For any inquiries, including Feedback, Questions, or Concerns, reach out on Slack!