Before ingesting ClickHouse metadata into Dawiso, prepare your account for authentication by creating a dedicated ClickHouse user and granting it the necessary permissions.

Dawiso supports the traditional authentication method using credentials to connect over HTTPS. Only read access is required — Dawiso does not modify your data.

Supported ClickHouse versions

  • ClickHouse 22.8 and later
  • ClickHouse Cloud

Connection prerequisites

  • Your ClickHouse account has administrator-level privileges (ACCESS MANAGEMENT role, or the ability to run CREATE USER and GRANT).
  • The HTTPS interface is reachable from Dawiso on the configured port (default 443).

Create new ClickHouse user

Create a new dedicated user (e.g., dawiso_reader) using the following statement:

CREATE USER dawiso_reader IDENTIFIED BY 'password123';
  • Replace password123 with a strong password.
  • If you choose a custom username, make sure to replace it in all following statements.

For more information, refer to the official ClickHouse documentation.

Grant permissions

Grant the newly created user the minimum required permissions to ingest ClickHouse metadata using the following statements:

GRANT SELECT ON system.* TO dawiso_reader;
GRANT SHOW TABLES, SHOW COLUMNS, SHOW DICTIONARIES ON *.* TO dawiso_reader;
  • SELECT ON system.* lets Dawiso read catalog tables (system.databases, system.tables, system.columns, system.dictionaries, system.functions, and related).
  • SHOW TABLES, SHOW COLUMNS, SHOW DICTIONARIES ON *.* is required because ClickHouse silently filters rows in system.* based on per-object SHOW grants. Without it, the system tables return zero rows for user databases.
Info

With these permissions, Dawiso ingests all object types except dictionary content — databases, tables, views, columns, projections, materialized views, and user-defined functions are all covered, including lineage. Dictionary metadata (entries and dictionary attributes) requires an additional grant — see below.

[Optional] Grant dictionary access

To ingest dictionary metadata and dictionary attributes, grant data-level SELECT on the databases (or individual dictionaries) that contain them:

GRANT SELECT ON my_database.* TO dawiso_reader;
  • Replace my_database with the name of the database that contains your dictionaries. Repeat for each database with dictionaries you want to ingest.
  • Alternatively, you can grant access to specific dictionaries only:
GRANT SELECT ON my_database.my_dictionary TO dawiso_reader;

Without this grant, dictionaries appear empty in system.dictionaries and dictionary attributes are not ingested.

Sample script

You can copy and paste the following script and run it on your ClickHouse server:

CREATE USER dawiso_reader IDENTIFIED BY 'password123';

GRANT SELECT ON system.* TO dawiso_reader;
GRANT SHOW TABLES, SHOW COLUMNS, SHOW DICTIONARIES ON *.* TO dawiso_reader;

-- Optional: dictionary content
GRANT SELECT ON my_database.* TO dawiso_reader;
  • Make sure to replace the following placeholders with real values:
    • password123 with a strong password.
    • my_database with the actual database name containing your dictionaries.
    • If you chose a custom user name, make sure to replace it in this snippet.