Movatterモバイル変換

login privilege

Only roles that have theLOGIN attribute can be used as the initial role name for a database connection. A role with theLOGIN attribute can be considered the same as a“database user”. To create a role with login privilege, use either:

CREATE ROLEname LOGIN;CREATE USERname;

(CREATE USER is equivalent toCREATE ROLE except thatCREATE USER assumesLOGIN by default, whileCREATE ROLE does not.)

superuser status

A database superuser bypasses all permission checks, except the right to log in. This is a dangerous privilege and should not be used carelessly; it is best to do most of your work as a role that is not a superuser. To create a new database superuser, useCREATE ROLEname SUPERUSER. You must do this as a role that is already a superuser.

database creation

A role must be explicitly given permission to create databases (except for superusers, since those bypass all permission checks). To create such a role, useCREATE ROLEname CREATEDB.

role creation

A role must be explicitly given permission to create more roles (except for superusers, since those bypass all permission checks). To create such a role, useCREATE ROLEname CREATEROLE. A role withCREATEROLE privilege can alter and drop other roles, too, as well as grant or revoke membership in them. However, to create, alter, drop, or change membership of a superuser role, superuser status is required;CREATEROLE is insufficient for that.

initiating replication

A role must explicitly be given permission to initiate streaming replication (except for superusers, since those bypass all permission checks). A role used for streaming replication must haveLOGIN permission as well. To create such a role, useCREATE ROLEname REPLICATION LOGIN.

password

A password is only significant if the client authentication method requires the user to supply a password when connecting to the database. Thepassword andmd5 authentication methods make use of passwords. Database passwords are separate from operating system passwords. Specify a password upon role creation withCREATE ROLEname PASSWORD 'string'.

Tip

It is good practice to create a role that has theCREATEDB andCREATEROLE privileges, but is not a superuser, and then use this role for all routine management of databases and roles. This approach avoids the dangers of operating as a superuser for tasks that do not really require it.