<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>52.8. pg_authid</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@lists.postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="prev" href="catalog-pg-attribute.html" title="52.7. pg_attribute" /><link rel="next" href="catalog-pg-auth-members.html" title="52.9. pg_auth_members" /></head><body><div xmlns="http://www.w3.org/TR/xhtml1/transitional" class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">52.8. <code xmlns="http://www.w3.org/1999/xhtml" class="structname">pg_authid</code></th></tr><tr><td width="10%" align="left"><a accesskey="p" href="catalog-pg-attribute.html" title="52.7. pg_attribute">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="catalogs.html" title="Chapter 52. System Catalogs">Up</a></td><th width="60%" align="center">Chapter 52. System Catalogs</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 11.5 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="catalog-pg-auth-members.html" title="52.9. pg_auth_members">Next</a></td></tr></table><hr></hr></div><div class="sect1" id="CATALOG-PG-AUTHID"><div class="titlepage"><div><div><h2 class="title" style="clear: both">52.8. <code class="structname">pg_authid</code></h2></div></div></div><a id="id-1.10.4.10.2" class="indexterm"></a><p>
The catalog <code class="structname">pg_authid</code> contains information about
database authorization identifiers (roles). A role subsumes the concepts
of <span class="quote">“<span class="quote">users</span>”</span> and <span class="quote">“<span class="quote">groups</span>”</span>. A user is essentially just a
role with the <code class="structfield">rolcanlogin</code> flag set. Any role (with or
without <code class="structfield">rolcanlogin</code>) can have other roles as members; see
<a class="link" href="catalog-pg-auth-members.html" title="52.9. pg_auth_members"><code class="structname">pg_auth_members</code></a>.
</p><p>
Since this catalog contains passwords, it must not be publicly readable.
<a class="link" href="view-pg-roles.html" title="52.81. pg_roles"><code class="structname">pg_roles</code></a>
is a publicly readable view on
<code class="structname">pg_authid</code> that blanks out the password field.
</p><p>
<a class="xref" href="user-manag.html" title="Chapter 21. Database Roles">Chapter 21</a> contains detailed information about user and
privilege management.
</p><p>
Because user identities are cluster-wide,
<code class="structname">pg_authid</code>
is shared across all databases of a cluster: there is only one
copy of <code class="structname">pg_authid</code> per cluster, not
one per database.
</p><div class="table" id="id-1.10.4.10.7"><p class="title"><strong>Table 52.8. <code class="structname">pg_authid</code> Columns</strong></p><div class="table-contents"><table class="table" summary="pg_authid Columns" border="1"><colgroup><col /><col /><col /></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code class="structfield">oid</code></td><td><code class="type">oid</code></td><td>Row identifier (hidden attribute; must be explicitly selected)</td></tr><tr><td><code class="structfield">rolname</code></td><td><code class="type">name</code></td><td>Role name</td></tr><tr><td><code class="structfield">rolsuper</code></td><td><code class="type">bool</code></td><td>Role has superuser privileges</td></tr><tr><td><code class="structfield">rolinherit</code></td><td><code class="type">bool</code></td><td>Role automatically inherits privileges of roles it is a
member of</td></tr><tr><td><code class="structfield">rolcreaterole</code></td><td><code class="type">bool</code></td><td>Role can create more roles</td></tr><tr><td><code class="structfield">rolcreatedb</code></td><td><code class="type">bool</code></td><td>Role can create databases</td></tr><tr><td><code class="structfield">rolcanlogin</code></td><td><code class="type">bool</code></td><td>
Role can log in. That is, this role can be given as the initial
session authorization identifier
</td></tr><tr><td><code class="structfield">rolreplication</code></td><td><code class="type">bool</code></td><td>
Role is a replication role. A replication role can initiate replication
connections and create and drop replication slots.
</td></tr><tr><td><code class="structfield">rolbypassrls</code></td><td><code class="type">bool</code></td><td>
Role bypasses every row level security policy, see
<a class="xref" href="ddl-rowsecurity.html" title="5.7. Row Security Policies">Section 5.7</a> for more information.
</td></tr><tr><td><code class="structfield">rolconnlimit</code></td><td><code class="type">int4</code></td><td>
For roles that can log in, this sets maximum number of concurrent
connections this role can make. -1 means no limit.
</td></tr><tr><td><code class="structfield">rolpassword</code></td><td><code class="type">text</code></td><td>
Password (possibly encrypted); null if none. The format depends
on the form of encryption used.
</td></tr><tr><td><code class="structfield">rolvaliduntil</code></td><td><code class="type">timestamptz</code></td><td>Password expiry time (only used for password authentication);
null if no expiration</td></tr></tbody></table></div></div><br class="table-break" /><p>
For an MD5 encrypted password, <code class="structfield">rolpassword</code>
column will begin with the string <code class="literal">md5</code> followed by a
32-character hexadecimal MD5 hash. The MD5 hash will be of the user's
password concatenated to their user name. For example, if user
<code class="literal">joe</code> has password <code class="literal">xyzzy</code>, <span class="productname">PostgreSQL</span>
will store the md5 hash of <code class="literal">xyzzyjoe</code>.
</p><p>
If the password is encrypted with SCRAM-SHA-256, it has the format:
</p><pre class="synopsis">
SCRAM-SHA-256$<em class="replaceable"><code><iteration count></code></em>:<em class="replaceable"><code><salt></code></em>$<em class="replaceable"><code><StoredKey></code></em>:<em class="replaceable"><code><ServerKey></code></em>
</pre><p>
where <em class="replaceable"><code>salt</code></em>, <em class="replaceable"><code>StoredKey</code></em> and
<em class="replaceable"><code>ServerKey</code></em> are in Base64 encoded format. This format is
the same as that specified by RFC 5803.
</p><p>
A password that does not follow either of those formats is assumed to be
unencrypted.
</p></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="catalog-pg-attribute.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="catalogs.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="catalog-pg-auth-members.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">52.7. <code class="structname">pg_attribute</code> </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 52.9. <code class="structname">pg_auth_members</code></td></tr></table></div></body></html>
