# Managing users and passwords

To manage users and passwords, Derby provides a group of system procedures.

- To create users for a database, the Database Owner calls `SYSCS_UTIL.SYSCS_CREATE_USER`, which takes a user name and password as arguments. This procedure can also be executed by a user or role to which the Database Owner has granted sufficient privileges.
- To remove a user, the Database Owner calls `SYSCS_UTIL.SYSCS_DROP_USER`, which takes one argument, the user name of the user. This procedure can also be executed by a user or role to which the Database Owner has granted sufficient privileges.
- To reset a forgotten or expired password, the Database Owner calls `SYSCS_UTIL.SYSCS_RESET_PASSWORD`, with a user name and password as arguments. This procedure can also be executed by a user or role to which the Database Owner has granted sufficient privileges.
- To change a user's own password, any user can call the system procedure `SYSCS_UTIL.SYSCS_MODIFY_PASSWORD`, which takes only one argument, the password. Typically, a user calls this procedure when their password is about to expire.

See the Derby Reference Manual for details on these procedures.

Parent topic: Configuring NATIVE authentication
Related concepts
Enabling NATIVE authentication explicitly
Working with a credentials database
NATIVE authentication and other database properties
Converting an existing database to use NATIVE authentication