↑↓ select ↵ open ⌫ change scope Open full search

PG.CENTER connects PostgreSQL documentation, reference, and ecosystem knowledge. Maintained by Pigsty.

SQLSTATE / CLASS 0P · INVALID ROLE SPECIFICATION

0P000

Read PG 18 manual ↗

invalid_role_specification

SQLSTATE
0P000
Condition name
invalid_role_specification
Class
Invalid Role Specification
Source macro
ERRCODE_INVALID_ROLE_SPECIFICATION
Evidence
Source path confirmed
Analysis & operational context

English SQLSTATE atlas: authored explanations and source/runtime evidence are separate from the manual definitions. View source ↗

<h1>0P000</h1>

At a glance

SQLSTATE 0P000 is invalid_role_specification in Class 0P. Under ENABLE_SSPI, the fixed Windows SSPI path uses it for server LOG branches while converting a SAM account name to a UPN; it is not a generic missing-role login result or a client ErrorResponse.

Meaning

0P000 is invalid_role_specification. In the fixed pg_SSPI_make_upn path, PostgreSQL builds DOMAIN\user, calls Windows TranslateName to obtain user@realm, and logs 0P000 when translation fails, the result has no @, or the realm/account would not fit the target buffers. These are server LOG branches under ENABLE_SSPI, not a client ErrorResponse and not a generic missing-role result.

Diagnosis

Confirm that the failing path is Windows SSPI and inspect the server log together with the SAM account/domain and configured realm or UPN mapping. TranslateName failures (including a result without @) log could not translate name; an oversized realm logs realm name too long, and an oversized translated account logs translated account name too long. A trust-auth disposable target cannot faithfully exercise this external identity boundary; a startup ErrorResponse may instead be 28000 or 28P01.

Response

Repair the SSPI account/realm mapping or Windows name translation configuration, then establish a new connection. Keep these server-log diagnostics separate from startup authentication responses, SQL role existence, and password failures.

Messages

The fixed SSPI source emits LOG with SQLSTATE 0P000 for these primary templates: could not translate name, realm name too long, and translated account name too long. These are server log records; a client exception or startup ErrorResponse without the matching server log is not proof of 0P000.

Representative case

This page has no selected natural SQL run. The structured evidence records a source or definition boundary; a client-side RAISE would not represent a backend mechanism.

Versions

The generated facts table records the locked catalogue snapshots and earliest observed definition. This page has no selected natural SQL run; the fixed REL_18_6/REL_10_23 SSPI source comparison must not be read as an observed runtime result or as a claim about every intermediate release.

Sources

  • src.auth-name-translation.18.6 — src/backend/libpq/auth.c at REL_18_6 commit 724edf9bde9d356724ad384a2e196edc3c9f80f7; fixed blob SHA-256 94252cb1e2c49b0ddb15f6596d0abf8056c84493de07cc81439da4c5b07018f1 (source).
  • src.auth-name-translation.10.23 — src/backend/libpq/auth.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61 (source).
  • src.auth-sspi-upn.10.23 — src/backend/libpq/auth.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61 (source).
  • src.calls.REL_18_6 / src.calls.REL_10_23 — fixed local call scans, SHA-256 9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf / 00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c; these scans preserve the resolved call context used by the claims.

Source evidence

Evidence belongs to the frozen source and runtime versions listed here. It is not a runtime verification of the selected manual version.

0P000 is the invalid_role_specification condition in Class 0P.

Method: Read the fixed errcodes.txt definition and the locked catalogue metadata.

Limits: Directory identity does not identify every backend or client path.

src.errcodes.18.6

Under ENABLE_SSPI, the fixed pg_SSPI_make_upn path builds a DOMAIN\user SAM name, calls Windows TranslateName to obtain a user@realm UPN, and logs 0P000 when translation fails, the result has no @, or the realm or translated account exceeds its target buffer. These are server LOG branches, not client ErrorResponse fields.

Method: Read the complete fixed SSPI authentication and pg_SSPI_make_upn paths in REL_18_6 and REL_10_23, including each explicit LOG branch.

Limits: This is a bounded source claim under ENABLE_SSPI; the disposable trust target cannot faithfully exercise it, and it is not an observed natural SQLSTATE case.

src.auth-name-translation.18.6 src.auth-name-translation.10.23 src.auth-sspi-upn.10.23

The locked catalogue records 0P000 in the listed snapshots; this page compares only the fixed REL_18_6 and REL_10_23 SSPI source paths and has no selected natural runtime.

Method: Read the generated facts block and fixed SSPI source records; no runtime result is used for this source-only page.

Limits: Presence in a definition file is not an exact behavioral introduction, and the fixed source paths do not prove every intermediate release or authentication configuration.

src.errcodes.18.6 src.auth-name-translation.18.6 src.auth-sspi-upn.10.23

Message templates

LOG · message.auth-name-translation

Primary

could not translate name
explicit LOG · message.auth-sspi-realm-too-long

Primary

realm name too long
explicit LOG · message.auth-sspi-account-too-long

Primary

translated account name too long

Reproduction & repair cases

source_boundary · PG 10, 18

Preconditions

  • A runner-owned disposable target is provisioned only if a source-boundary smoke run is requested.

Trigger: No artificial SQL trigger is executed; this record preserves the fixed source/definition boundary.

Expected assertions

    Repair: Use the concrete source path or component-specific documentation when it applies.

    Cleanup: Drop the case schema with an owner connection.

    Recorded runtime evidence

    No runtime observation is attached to this entry.

    Definition snapshot: english-manuals:b397e91735692cdb6c7ebc210e0… · English manual source