Using the CREATE USER statement, you can only create users in the _User table. Users defined in other user accounts must be created outside of SQL. Use the following syntax to employ the CREATE USER statement:

CREATE USER {'username'|'username@domain_name'}, 'password' ;

Examples: CREATE USER statement

In the following example, an account with DBA privileges creates the 'username' 'GPS' with 'password' 'star'.

CREATE USER 'GPS', 'star';

In the following example, CREATE USER creates the user Jasper to connect to mtdomain domain with the password spaniel:

CREATE USER 'Jasper@mtdomain', 'spaniel' ;

The user Jasper should be associated with the tenant identified by the domain mtdomain.

A user's password can be changed easily by using the ALTER USER statement, as shown:

ALTER USER { 'username'|'username@domain_name' }, 'old_password', 'new_password';

To set a new password without specifying the old password, use the following syntax:

ALTER USER 'username', 'new_password';

Examples: ALTER USER statement

The following example demonstrates the use of the ALTER USER statement:

ALTER USER 'GPS', 'star', 'star1';

The following example demonstrates how to change the password for a user associated with a domain. The following ALTER USER statement changes the password from normandy to brittany for the user Jasper associated with mtdomain domain:

ALTER USER 'Jasper@mtdomain', 'normandy', 'brittany' ;

When users are created, the default DBA (the user who created the database) becomes disabled. It is important to grant DBA privileges to at least one user so you will have a valid DBA account.

For complete details on the CREATE USER statement, see OpenEdge SQL Reference.

Password regeneration

Starting with OpenEdge Release 13.0, the CREATE USER and ALTER USER SQL statements use Password-Based Key Derivation Function 2 (PBKDF2) to generate passwords. PBKDF2 is a FIPS-approved cryptographic algorithm. This enhancement applies by default, regardless of whether FIPS mode is enabled on the OpenEdge installation.

When FIPS mode is disabled, users created in OpenEdge Release 12.8 or earlier can login to OpenEdge Release 13.0 database. Database Administrators can run the ALTER USER statement to regenerate passwords using PBKDF2 for FIPS compliance.

When FIPS mode is enabled, only users with PBKDF2-based password hashes are allowed to log in. Users created in OpenEdge Release 12.8 or earlier cannot log in because their passwords are not FIPS-compliant.

For more information, see FIPS mode.