Wiki / Authentication Methods

Definitions for PostgreSQL 18

• bsdAuthentication and access control10 – 20

  Authenticate using the BSD Authentication service provided by the operating system. See Section 20.14 for details.

  1011121314151617181920
• certAuthentication and access control10 – 20

  Authenticate using SSL client certificates. See Section 20.12 for details.

  1011121314151617181920
• gssAuthentication and access control10 – 20

  Use GSSAPI to authenticate the user. This is only available for TCP/IP connections. See Section 20.6 for details. It can be used in conjunction with GSSAPI encryption.

  1011121314151617181920
• identAuthentication and access control10 – 20

  Obtain the operating system user name of the client by contacting the ident server on the client and check if it matches the requested database user name. Ident authentication can only be used on TCP/IP connections. When specified for local connections, peer authentication will be used instead. See Section 20.8 for details.

  1011121314151617181920
• ldapAuthentication and access control10 – 20

  Authenticate using an LDAP server. See Section 20.10 for details.

  1011121314151617181920
• md5Password authentication10 – 20

  Perform SCRAM-SHA-256 or MD5 authentication to verify the user's password. See Section 20.5 for details. Warning Support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL . Refer to Section 20.5 for details about migrating to another password type.

  1011121314151617181920
• oauthAuthentication and access control18 – 20

  Authorize and optionally authenticate using a third-party OAuth 2.0 identity provider. See Section 20.15 for details.

  1011121314151617181920
• pamAuthentication and access control10 – 20

  Authenticate using the Pluggable Authentication Modules (PAM) service provided by the operating system. See Section 20.13 for details.

  1011121314151617181920
• passwordPassword authentication10 – 20

  Require the client to supply an unencrypted password for authentication. Since the password is sent in clear text over the network, this should not be used on untrusted networks. See Section 20.5 for details.

  1011121314151617181920
• peerAuthentication and access control10 – 20

  Obtain the client's operating system user name from the operating system and check if it matches the requested database user name. This is only available for local connections. See Section 20.9 for details.

  1011121314151617181920
• radiusAuthentication and access control10 – 18

  Authenticate using a RADIUS server. See Section 20.11 for details.

  1011121314151617181920
• rejectAuthentication and access control10 – 20

  Reject the connection unconditionally. This is useful for “ filtering out ” certain hosts from a group, for example a reject line could block a specific host from connecting, while a later line allows the remaining hosts in a specific network to connect.

  1011121314151617181920
• scram-sha-256Password authentication10 – 20

  Perform SCRAM-SHA-256 authentication to verify the user's password. See Section 20.5 for details.

  1011121314151617181920
• sspiAuthentication and access control10 – 20

  Use SSPI to authenticate the user. This is only available on Windows. See Section 20.7 for details.

  1011121314151617181920
• trustAuthentication and access control10 – 20

  Allow the connection unconditionally. This method allows anyone that can connect to the PostgreSQL database server to login as any PostgreSQL user they wish, without the need for a password or any other authentication. See Section 20.4 for details.

  1011121314151617181920