pg_authid
The catalog pg_authid contains information about database authorization identifiers (roles). A role subsumes the concepts of “users” and “groups”. A user is essentially just a role with the rolcanlogin flag set. Any role (with or without rolcanlogin) can have other roles as members; see pg_auth_members. Since this catalog contains passwords, it must not be publicly readable. pg_roles is a publicly readable view on pg_authid that blanks out the password field. Chapter 21 contains detailed information about user and privilege management. Because user identities are cluster-wide, pg_authid is shared across all databases of a cluster: there is only one copy of pg_authid per cluster, not one per database.
English manual coverage begins with PostgreSQL 7.4. Source history and runtime observations have their own recorded version boundaries.
Reading PG 18·Select a recorded version
- kind
- catalog
- lang
- en
- measured attributes
- true
- metadata release
- 18.6
- runtime columns
- oid, rolname, rolsuper, rolinherit, rolcreaterole, rolcreatedb, rolcanlogin, rolreplication, rolbypassrls, rolconnlimit, rolpassword, rolvaliduntil
- runtime verified
- false
- source
- english-manual
Definition PG 18
The catalog pg_authid contains information about database authorization identifiers (roles). A role subsumes the concepts of “users” and “groups”. A user is essentially just a role with the rolcanlogin flag set. Any role (with or without rolcanlogin) can have other roles as members; see pg_auth_members. Since this catalog contains passwords, it must not be publicly readable. pg_roles is a publicly readable view on pg_authid that blanks out the password field. Chapter 21 contains detailed information about user and privilege management. Because user identities are cluster-wide, pg_authid is shared across all databases of a cluster: there is only one copy of pg_authid per cluster, not one per database.
Catalog columns
| Column | Type | Nullability | Description |
|---|---|---|---|
| oid | oid | Not null | Row identifier |
| rolname | name | Not null | Role name |
| rolsuper | bool | Not null | Role has superuser privileges |
| rolinherit | bool | Not null | Role automatically inherits privileges of roles it is a member of |
| rolcreaterole | bool | Not null | Role can create more roles |
| rolcreatedb | bool | Not null | Role can create databases |
| rolcanlogin | bool | Not null | Role can log in. That is, this role can be given as the initial session authorization identifier. |
| rolreplication | bool | Not null | Role is a replication role. A replication role can initiate replication connections and create and drop replication slots. |
| rolbypassrls | bool | Not null | Role bypasses every row-level security policy, see Section 5.9 for more information. |
| rolconnlimit | int4 | Not null | For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit. |
| rolpassword | text | Nullable | Encrypted password; null if none. The format depends on the form of encryption used. |
| rolvaliduntil | timestamptz | Nullable | Password expiry time (only used for password authentication); null if no expiration |
Compare versions
Source references
Full definition and evidence JSON
Definition sources
center · PostgreSQL 18 · catalog-bilingual-repair:28dbfaf387a11f0d2d1fc71bd3ac1cca6bbf26418f5147bbd6be341b4546c6f4
Text language: en · catalog-bilingual-repair:28dbfaf387a11f0d2d1fc71bd3ac1cca6bbf26418f5147bbd6be341b4546c6f4