codekingpro/portable-devtools

1<?xml version="1.0" encoding="UTF-8" standalone="no"?>2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>22.1. Database Roles</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="user-manag.html" title="Chapter 22. Database Roles" /><link rel="next" href="role-attributes.html" title="22.2. Role Attributes" /></head><body id="docContent" class="container-fluid col-10"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">22.1. Database Roles</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="user-manag.html" title="Chapter 22. Database Roles">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="user-manag.html" title="Chapter 22. Database Roles">Up</a></td><th width="60%" align="center">Chapter 22. Database Roles</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="role-attributes.html" title="22.2. Role Attributes">Next</a></td></tr></table><hr /></div><div class="sect1" id="DATABASE-ROLES"><div class="titlepage"><div><div><h2 class="title" style="clear: both">22.1. Database Roles <a href="#DATABASE-ROLES" class="id_link">#</a></h2></div></div></div><a id="id-1.6.9.5.2" class="indexterm"></a><a id="id-1.6.9.5.3" class="indexterm"></a><a id="id-1.6.9.5.4" class="indexterm"></a><a id="id-1.6.9.5.5" class="indexterm"></a><p>3   Database roles are conceptually completely separate from4   operating system users. In practice it might be convenient to5   maintain a correspondence, but this is not required. Database roles6   are global across a database cluster installation (and not7   per individual database). To create a role use the <a class="link" href="sql-createrole.html" title="CREATE ROLE"><code class="command">CREATE ROLE</code></a> SQL command:8</p><pre class="synopsis">9CREATE ROLE <em class="replaceable"><code>name</code></em>;10</pre><p>11   <em class="replaceable"><code>name</code></em> follows the rules for SQL12   identifiers: either unadorned without special characters, or13   double-quoted.  (In practice, you will usually want to add additional14   options, such as <code class="literal">LOGIN</code>, to the command.  More details appear15   below.)  To remove an existing role, use the analogous16   <a class="link" href="sql-droprole.html" title="DROP ROLE"><code class="command">DROP ROLE</code></a> command:17</p><pre class="synopsis">18DROP ROLE <em class="replaceable"><code>name</code></em>;19</pre><p>20  </p><a id="id-1.6.9.5.7" class="indexterm"></a><a id="id-1.6.9.5.8" class="indexterm"></a><p>21   For convenience, the programs <a class="xref" href="app-createuser.html" title="createuser"><span class="refentrytitle"><span class="application">createuser</span></span></a>22   and <a class="xref" href="app-dropuser.html" title="dropuser"><span class="refentrytitle"><span class="application">dropuser</span></span></a> are provided as wrappers23   around these SQL commands that can be called from the shell command24   line:25</p><pre class="synopsis">26createuser <em class="replaceable"><code>name</code></em>27dropuser <em class="replaceable"><code>name</code></em>28</pre><p>29  </p><p>30   To determine the set of existing roles, examine the <code class="structname">pg_roles</code>31   system catalog, for example:32</p><pre class="synopsis">33SELECT rolname FROM pg_roles;34</pre><p>35   or to see just those capable of logging in:36</p><pre class="synopsis">37SELECT rolname FROM pg_roles WHERE rolcanlogin;38</pre><p>39   The <a class="xref" href="app-psql.html" title="psql"><span class="refentrytitle"><span class="application">psql</span></span></a> program's <code class="literal">\du</code> meta-command40   is also useful for listing the existing roles.41  </p><p>42   In order to bootstrap the database system, a freshly initialized43   system always contains one predefined login-capable role. This role44   is always a <span class="quote">“<span class="quote">superuser</span>”</span>, and it will have45   the same name as the operating system user that initialized the46   database cluster with <code class="command">initdb</code> unless a different name47   is specified.  This role is often named48   <code class="literal">postgres</code>. In order to create more roles you49   first have to connect as this initial role.50  </p><p>51   Every connection to the database server is made using the name of some52   particular role, and this role determines the initial access privileges for53   commands issued in that connection.54   The role name to use for a particular database55   connection is indicated by the client that is initiating the56   connection request in an application-specific fashion. For example,57   the <code class="command">psql</code> program uses the58   <code class="option">-U</code> command line option to indicate the role to59   connect as.  Many applications assume the name of the current60   operating system user by default (including61   <code class="command">createuser</code> and <code class="command">psql</code>).  Therefore it62   is often convenient to maintain a naming correspondence between63   roles and operating system users.64  </p><p>65   The set of database roles a given client connection can connect as66   is determined by the client authentication setup, as explained in67   <a class="xref" href="client-authentication.html" title="Chapter 21. Client Authentication">Chapter 21</a>. (Thus, a client is not68   limited to connect as the role matching69   its operating system user, just as a person's login name70   need not match his or her real name.)  Since the role71   identity determines the set of privileges available to a connected72   client, it is important to carefully configure privileges when setting up73   a multiuser environment.74  </p></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="user-manag.html" title="Chapter 22. Database Roles">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="user-manag.html" title="Chapter 22. Database Roles">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="role-attributes.html" title="22.2. Role Attributes">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 22. Database Roles </td><td width="20%" align="center"><a accesskey="h" href="index.html" title="PostgreSQL 16.3 Documentation">Home</a></td><td width="40%" align="right" valign="top"> 22.2. Role Attributes</td></tr></table></div></body></html>