Bỏ qua

ClickHouse Authentication Fix

Problem

You were unable to connect to ClickHouse via DBeaver and Signoz registration was failing because:

  1. ClickHouse Authentication: Newer versions of ClickHouse require a password for the default user when connecting from external clients (like DBeaver)
  2. Empty Password: The docker-compose configuration had CLICKHOUSE_PASSWORD: "" (empty string), which ClickHouse rejects
  3. Signoz Connection: Signoz Query Service couldn't authenticate to ClickHouse, causing registration failures

Solution

Changes Made

  1. Set ClickHouse Password in docker-compose.dev.yml:

yaml environment: CLICKHOUSE_USER: ${CLICKHOUSE_USER:-default} CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-clickhouse123} CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: '1' # Enable network access

  1. Updated Signoz Query Service connection string to include credentials:

yaml ClickHouseUrl: tcp://${CLICKHOUSE_USER:-default}:${CLICKHOUSE_PASSWORD:-clickhouse123}@clickhouse:9000?database=signoz

  1. Updated OTEL Collector DSN strings to include credentials

  2. Added environment variables to env.development.example: bash CLICKHOUSE_USER=default CLICKHOUSE_PASSWORD=clickhouse123

How to Apply the Fix

Step 1: Update Environment File

If you have a .env.development file, add:

CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=clickhouse123

Or copy from example:

cp env.development.example .env.development

Step 2: Restart ClickHouse and Signoz Services

# Stop existing containers
docker compose -f docker-compose.dev.yml stop clickhouse signoz-query-service signoz-otel-collector

# Remove ClickHouse volume (if you want fresh start with new password)
# WARNING: This will delete all existing data!
docker compose -f docker-compose.dev.yml down -v clickhouse

# Start services with new configuration
docker compose -f docker-compose.dev.yml up -d clickhouse signoz-query-service signoz-otel-collector signoz-frontend

Step 3: Verify Connection

Test ClickHouse Connection via HTTP:

curl 'http://localhost:8123/?user=default&password=clickhouse123' -d 'SELECT 1'

Should return: 1

Test via DBeaver:

  1. Connection Settings:
  2. Host: localhost
  3. Port: 8123 (HTTP) or 9000 (Native)
  4. Database: signoz
  5. Username: default

  6. Password: clickhouse123

  7. JDBC URL (for Generic JDBC): jdbc:clickhouse://localhost:8123/signoz?user=default&password=clickhouse123

Test Signoz Registration:

  1. Go to http://localhost:3301/signup
  2. Fill in registration form
  3. Should now work without authentication errors

Why This Happened

ClickHouse Security Model

  1. Default Behavior: ClickHouse's default user has no password by default
  2. Network Access: However, network access for default is disabled unless:
  3. A password is explicitly set, OR
  4. Access management is explicitly enabled
  5. Version Changes: Newer ClickHouse versions (25.x) enforce stricter authentication requirements

The Error Message Explained

The error you saw:

Authentication failed: password is incorrect, or there is no user with such name.
(REQUIRED_PASSWORD)

This means:

  • ClickHouse detected a connection attempt from an external client (DBeaver)
  • The default user requires a password for network access
  • No password was provided (empty string), so authentication failed

Security Notes

⚠️ For Production:

  • Use a strong, unique password
  • Store credentials in environment variables or secrets manager
  • Consider creating dedicated users with minimal privileges
  • Enable SSL/TLS for connections

✅ For Development:

  • The default password clickhouse123 is acceptable
  • Can be changed via CLICKHOUSE_PASSWORD environment variable

Troubleshooting

If Signoz still can't connect:

  1. Check ClickHouse logs:

bash docker logs clickhouse

  1. Verify password is set:

bash docker exec clickhouse clickhouse-client --query "SELECT 1" --user default --password clickhouse123

  1. Check Signoz Query Service logs:

bash docker logs signoz-query-service

  1. Verify environment variables: bash docker exec signoz-query-service env | grep CLICKHOUSE

If DBeaver still can't connect:

  1. Verify port mapping: Check that ports 8123 and 9000 are exposed
  2. Try HTTP interface first: Use port 8123 with HTTP driver
  3. Check firewall: Ensure Docker ports are accessible
  4. Try native interface: Use port 9000 with native ClickHouse driver

If you really want passwordless access (development only), you can:

  1. Remove password requirement in ClickHouse config (requires custom config file)
  2. Use CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1" without password (less secure)

However, setting a password is the recommended approach and what we've implemented.