49.8. pg_authid
The catalogpg_authid contains information about database authorization identifiers (roles). A role subsumes the concepts of“users” and“groups”. A user is essentially just a role with therolcanlogin flag set. Any role (with or withoutrolcanlogin) can have other roles as members; seepg_auth_members.
Since this catalog contains passwords, it must not be publicly readable.pg_roles is a publicly readable view onpg_authid that blanks out the password field.
Chapter 20 contains detailed information about user and privilege management.
Because user identities are cluster-wide,pg_authid is shared across all databases of a cluster: there is only one copy ofpg_authid per cluster, not one per database.
Table 49.8. pg_authid Columns
| Name | Type | Description |
|---|---|---|
oid | oid | Row identifier (hidden attribute; must be explicitly selected) |
rolname | name | Role name |
rolsuper | bool | Role has superuser privileges |
rolinherit | bool | Role automatically inherits privileges of roles it is a member of |
rolcreaterole | bool | Role can create more roles |
rolcreatedb | bool | Role can create databases |
rolcanlogin | bool | Role can log in. That is, this role can be given as the initial session authorization identifier |
rolreplication | bool | Role is a replication role. That is, this role can initiate streaming replication (seeSection 25.2.5) and set/unset the system backup mode usingpg_start_backup andpg_stop_backup |
rolbypassrls | bool | Role bypasses every row level security policy, seeSection 5.7 for more information. |
rolconnlimit | int4 | For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit. |
rolpassword | text | Password (possibly encrypted); null if none. If the password is encrypted, this column will begin with the stringmd5 followed by a 32-character hexadecimal MD5 hash. The MD5 hash will be of the user's password concatenated to their user name. For example, if userjoe has passwordxyzzy,Postgres Pro will store the md5 hash ofxyzzyjoe. A password that does not follow that format is assumed to be unencrypted. |
rolvaliduntil | timestamptz | Password expiry time (only used for password authentication); null if no expiration |