Postgres Pro Enterprise : Documentation: 15: 55.8. pg

55.8. `pg_authid`
Prev	Up	Chapter 55. System Catalogs	Home	Next

55.8. `pg_authid`

The catalog pg_authid contains information about database authorization identifiers (roles). A role subsumes the concepts of “users” and “groups”. A user is essentially just a role with the rolcanlogin flag set. Any role (with or without rolcanlogin) can have other roles as members; see pg_auth_members.

Since this catalog contains passwords, it must not be publicly readable. pg_roles is a publicly readable view on pg_authid that blanks out the password field.

Chapter 21 contains detailed information about user and privilege management.

Because user identities are cluster-wide, pg_authid is shared across all databases of a cluster: there is only one copy of pg_authid per cluster, not one per database.

Table 55.8. pg_authid Columns

Column Type Description
`oid` `oid` Row identifier
`rolname` `name` Role name
`rolsuper` `bool` Role has superuser privileges
`rolinherit` `bool` Role automatically inherits privileges of roles it is a member of
`rolcreaterole` `bool` Role can create more roles
`rolcreatedb` `bool` Role can create databases
`rolcanlogin` `bool` Role can log in. That is, this role can be given as the initial session authorization identifier.
`rolreplication` `bool` Role is a replication role. A replication role can initiate replication connections and create and drop replication slots.
`rolbypassrls` `bool` Role bypasses every row-level security policy, see Section 5.8 for more information.
`rolconnlimit` `int4` For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit.
`rolprofile` `regprofile` (references `pg_profile`.`oid`) The OID of the role's profile
`rolloginattempts` `int4` Number of consecutive failed login attempts of a user. It is always `0` if `FAILED_LOGIN_ATTEMPTS` value of the corresponding role profile is `UNLIMITED` (see CREATE PROFILE). After a successful login, `rolloginattempts` is reset to `0`.
`rollastlogin` `timestamptz` The timestamp the role logged in last time
`rolfirstfailedauth` `timestamptz` The timestamp of the role's first authentication failure
`rolstatus` `int2` Status of the role: `0` for the active role, `1` the role is manually locked (see `ACCOUNT LOCK` in ALTER ROLE), `2` the role is locked because of inactivity (see parameter `USER_INACTIVE_TIME` in CREATE PROFILE), `4` the role is locked because the number of consecutive authentication failures has reached the limit (see parameter `FAILED_LOGIN_ATTEMPTS` in CREATE PROFILE)
`rolpassword` `text` Password (possibly encrypted); null if none. The format depends on the form of encryption used.
`rolvaliduntil` `timestamptz` Password expiry time (only used for password authentication); null if no expiration
`rolpasssetat` `timestamptz` Password set time (only used for password authentication); null if password is not set.

Column Type

Description

oid oid

Row identifier

rolname name

Role name

rolsuper bool

Role has superuser privileges

rolinherit bool

Role automatically inherits privileges of roles it is a member of

rolcreaterole bool

Role can create more roles

rolcreatedb bool

Role can create databases

rolcanlogin bool

Role can log in. That is, this role can be given as the initial session authorization identifier.

rolreplication bool

Role is a replication role. A replication role can initiate replication connections and create and drop replication slots.

rolbypassrls bool

Role bypasses every row-level security policy, see Section 5.8 for more information.

rolconnlimit int4

For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit.

rolprofile regprofile (references pg_profile.oid)

The OID of the role's profile

rolloginattempts int4

Number of consecutive failed login attempts of a user. It is always 0 if FAILED_LOGIN_ATTEMPTS value of the corresponding role profile is UNLIMITED (see CREATE PROFILE). After a successful login, rolloginattempts is reset to 0.

rollastlogin timestamptz

The timestamp the role logged in last time

rolfirstfailedauth timestamptz

The timestamp of the role's first authentication failure

rolstatus int2

Status of the role: 0 for the active role, 1 the role is manually locked (see ACCOUNT LOCK in ALTER ROLE), 2 the role is locked because of inactivity (see parameter USER_INACTIVE_TIME in CREATE PROFILE), 4 the role is locked because the number of consecutive authentication failures has reached the limit (see parameter FAILED_LOGIN_ATTEMPTS in CREATE PROFILE)

rolpassword text

Password (possibly encrypted); null if none. The format depends on the form of encryption used.

rolvaliduntil timestamptz

Password expiry time (only used for password authentication); null if no expiration

rolpasssetat timestamptz

Password set time (only used for password authentication); null if password is not set.

For an MD5 encrypted password, rolpassword column will begin with the string md5 followed by a 32-character hexadecimal MD5 hash. The MD5 hash will be of the user's password concatenated to their user name. For example, if user joe has password xyzzy, Postgres Pro will store the md5 hash of xyzzyjoe.

If the password is encrypted with SCRAM-SHA-256, it has the format:

SCRAM-SHA-256$<iteration count>:<salt>$<StoredKey>:<ServerKey>

where salt, StoredKey and ServerKey are in Base64 encoded format. This format is the same as that specified by RFC 5803.

A password that does not follow either of those formats is assumed to be unencrypted.

Prev	Up	Next
55.7. `pg_attribute`	Home	55.9. `pg_auth_members`

epub pdf

55.8. pg_authid

55.8. `pg_authid`