From d67a596fc3cfc7613fbdd0c5aff6866508aa1188 Mon Sep 17 00:00:00 2001 From: katarinasupe Date: Wed, 28 Oct 2026 10:49:02 +0100 Subject: [PATCH] Say that a custom user or role name regex needs Enterprise --- .../authentication-and-authorization/users.mdx | 7 +++++++ pages/database-management/configuration.mdx | 2 +- pages/database-management/enabling-memgraph-enterprise.mdx | 6 ++++++ 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/pages/database-management/authentication-and-authorization/users.mdx b/pages/database-management/authentication-and-authorization/users.mdx index 197d43c80..7d8547836 100644 --- a/pages/database-management/authentication-and-authorization/users.mdx +++ b/pages/database-management/authentication-and-authorization/users.mdx @@ -52,6 +52,13 @@ If you want to create a username that includes a space character, you must set the `--auth-user-or-role-name-regex` flag to include spaces. For example, `--auth-user-or-role-name-regex=[a-zA-Z0-9_.+\-@ ]+`. +A custom value for this flag requires a [Memgraph Enterprise +license](/database-management/enabling-memgraph-enterprise). Without one, +Memgraph starts, but every `CREATE USER` query fails with the `Custom user/role +regex is a Memgraph Enterprise feature` error, even for names the default +pattern allows. In Memgraph Community, remove the flag or set it back to its +default, `[a-zA-Z0-9_.+-@]+`. + If the user should authenticate themselves on each session, i.e. provide their password on each session, the part within the brackets is mandatory. Otherwise, the password is set to `null`, and the user will be allowed to log-in using diff --git a/pages/database-management/configuration.mdx b/pages/database-management/configuration.mdx index 20b0338f5..e05c35209 100644 --- a/pages/database-management/configuration.mdx +++ b/pages/database-management/configuration.mdx @@ -397,7 +397,7 @@ auth module authentication and authorization mechanisms used by Memgraph. | `--auth-module-timeout-ms` | Specifies the maximum time that Memgraph will wait for a response from the external auth module. | | `--auth-password-permit-null` | Can be set to false to disable null passwords. | | `--auth-password-strength-regex` | The regular expression that should be used to match the entire entered password to ensure its strength. The syntax for regular expressions is derived from a [modified version of the ECMAScript regular expression grammar](https://en.cppreference.com/w/cpp/regex/ecmascript). | -| `--auth-user-or-role-name-regex` | Set to the regular expression that each user or role name must fulfill. The syntax for regular expressions is derived from a [modified version of the ECMAScript regular expression grammar](https://en.cppreference.com/w/cpp/regex/ecmascript). | +| `--auth-user-or-role-name-regex` | Set to the regular expression that each user or role name must fulfill. The syntax for regular expressions is derived from a [modified version of the ECMAScript regular expression grammar](https://en.cppreference.com/w/cpp/regex/ecmascript). The default is `[a-zA-Z0-9_.+-@]+`. A custom value requires a [Memgraph Enterprise license](/database-management/enabling-memgraph-enterprise). | ### Bolt diff --git a/pages/database-management/enabling-memgraph-enterprise.mdx b/pages/database-management/enabling-memgraph-enterprise.mdx index 35a3efd8f..38ea96546 100644 --- a/pages/database-management/enabling-memgraph-enterprise.mdx +++ b/pages/database-management/enabling-memgraph-enterprise.mdx @@ -218,6 +218,12 @@ passwords are replaced with **** to prevent their exposure in the logs. This approach ensures that even if logs are accessed by unauthorized individuals, they won’t be able to retrieve the actual passwords. +### Custom user and role names + +With Memgraph Enterprise, you can allow other characters, such as spaces, in +user and role names by setting the `--auth-user-or-role-name-regex` flag. See +the [Users page](/database-management/authentication-and-authorization/users#administer-users). + ## Logging and monitoring ### Audit log