codekingpro/portable-devtools

1<?xml version="1.0" encoding="UTF-8" standalone="no"?>2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>53.8. pg_authid</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="catalog-pg-attribute.html" title="53.7. pg_attribute" /><link rel="next" href="catalog-pg-auth-members.html" title="53.9. pg_auth_members" /></head><body id="docContent" class="container-fluid col-10"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">53.8. <code class="structname">pg_authid</code></th></tr><tr><td width="10%" align="left"><a accesskey="p" href="catalog-pg-attribute.html" title="53.7. pg_attribute">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="catalogs.html" title="Chapter 53. System Catalogs">Up</a></td><th width="60%" align="center">Chapter 53. System Catalogs</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="catalog-pg-auth-members.html" title="53.9. pg_auth_members">Next</a></td></tr></table><hr /></div><div class="sect1" id="CATALOG-PG-AUTHID"><div class="titlepage"><div><div><h2 class="title" style="clear: both">53.8. <code class="structname">pg_authid</code> <a href="#CATALOG-PG-AUTHID" class="id_link">#</a></h2></div></div></div><a id="id-1.10.4.10.2" class="indexterm"></a><p>3   The catalog <code class="structname">pg_authid</code> contains information about4   database authorization identifiers (roles).  A role subsumes the concepts5   of <span class="quote">“<span class="quote">users</span>”</span> and <span class="quote">“<span class="quote">groups</span>”</span>.  A user is essentially just a6   role with the <code class="structfield">rolcanlogin</code> flag set.  Any role (with or7   without <code class="structfield">rolcanlogin</code>) can have other roles as members; see8   <a class="link" href="catalog-pg-auth-members.html" title="53.9. pg_auth_members"><code class="structname">pg_auth_members</code></a>.9  </p><p>10   Since this catalog contains passwords, it must not be publicly readable.11   <a class="link" href="view-pg-roles.html" title="54.20. pg_roles"><code class="structname">pg_roles</code></a>12   is a publicly readable view on13   <code class="structname">pg_authid</code> that blanks out the password field.14  </p><p>15   <a class="xref" href="user-manag.html" title="Chapter 22. Database Roles">Chapter 22</a> contains detailed information about user and16   privilege management.17  </p><p>18   Because user identities are cluster-wide,19   <code class="structname">pg_authid</code>20   is shared across all databases of a cluster: there is only one21   copy of <code class="structname">pg_authid</code> per cluster, not22   one per database.23  </p><div class="table" id="id-1.10.4.10.7"><p class="title"><strong>Table 53.8. <code class="structname">pg_authid</code> Columns</strong></p><div class="table-contents"><table class="table" summary="pg_authid Columns" border="1"><colgroup><col /></colgroup><thead><tr><th class="catalog_table_entry"><p class="column_definition">24       Column Type25      </p>26      <p>27       Description28      </p></th></tr></thead><tbody><tr><td class="catalog_table_entry"><p class="column_definition">29       <code class="structfield">oid</code> <code class="type">oid</code>30      </p>31      <p>32       Row identifier33      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">34       <code class="structfield">rolname</code> <code class="type">name</code>35      </p>36      <p>37       Role name38      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">39       <code class="structfield">rolsuper</code> <code class="type">bool</code>40      </p>41      <p>42       Role has superuser privileges43      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">44       <code class="structfield">rolinherit</code> <code class="type">bool</code>45      </p>46      <p>47       Role automatically inherits privileges of roles it is a48       member of49      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">50       <code class="structfield">rolcreaterole</code> <code class="type">bool</code>51      </p>52      <p>53       Role can create more roles54      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">55       <code class="structfield">rolcreatedb</code> <code class="type">bool</code>56      </p>57      <p>58       Role can create databases59      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">60       <code class="structfield">rolcanlogin</code> <code class="type">bool</code>61      </p>62      <p>63       Role can log in. That is, this role can be given as the initial64       session authorization identifier.65      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">66       <code class="structfield">rolreplication</code> <code class="type">bool</code>67      </p>68      <p>69       Role is a replication role. A replication role can initiate replication70       connections and create and drop replication slots.71      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">72       <code class="structfield">rolbypassrls</code> <code class="type">bool</code>73      </p>74      <p>75       Role bypasses every row-level security policy, see76       <a class="xref" href="ddl-rowsecurity.html" title="5.8. Row Security Policies">Section 5.8</a> for more information.77      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">78       <code class="structfield">rolconnlimit</code> <code class="type">int4</code>79      </p>80      <p>81       For roles that can log in, this sets maximum number of concurrent82       connections this role can make.  -1 means no limit.83      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">84       <code class="structfield">rolpassword</code> <code class="type">text</code>85      </p>86      <p>87       Password (possibly encrypted); null if none. The format depends88       on the form of encryption used.89      </p></td></tr><tr><td class="catalog_table_entry"><p class="column_definition">90       <code class="structfield">rolvaliduntil</code> <code class="type">timestamptz</code>91      </p>92      <p>93       Password expiry time (only used for password authentication);94       null if no expiration95      </p></td></tr></tbody></table></div></div><br class="table-break" /><p>96   For an MD5 encrypted password, <code class="structfield">rolpassword</code>97   column will begin with the string <code class="literal">md5</code> followed by a98   32-character hexadecimal MD5 hash. The MD5 hash will be of the user's99   password concatenated to their user name. For example, if user100   <code class="literal">joe</code> has password <code class="literal">xyzzy</code>, <span class="productname">PostgreSQL</span>101   will store the md5 hash of <code class="literal">xyzzyjoe</code>.102  </p><p>103   If the password is encrypted with SCRAM-SHA-256, it has the format:104</p><pre class="synopsis">105SCRAM-SHA-256$<em class="replaceable"><code>&lt;iteration count&gt;</code></em>:<em class="replaceable"><code>&lt;salt&gt;</code></em>$<em class="replaceable"><code>&lt;StoredKey&gt;</code></em>:<em class="replaceable"><code>&lt;ServerKey&gt;</code></em>106</pre><p>107   where <em class="replaceable"><code>salt</code></em>, <em class="replaceable"><code>StoredKey</code></em> and108   <em class="replaceable"><code>ServerKey</code></em> are in Base64 encoded format. This format is109   the same as that specified by <a class="ulink" href="https://datatracker.ietf.org/doc/html/rfc5803" target="_top">RFC 5803</a>.110  </p><p>111    A password that does not follow either of those formats is assumed to be112    unencrypted.113  </p></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="catalog-pg-attribute.html" title="53.7. pg_attribute">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="catalogs.html" title="Chapter 53. System Catalogs">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="catalog-pg-auth-members.html" title="53.9. pg_auth_members">Next</a></td></tr><tr><td width="40%" align="left" valign="top">53.7. <code class="structname">pg_attribute</code> </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="40%" align="right" valign="top"> 53.9. <code class="structname">pg_auth_members</code></td></tr></table></div></body></html>