0P000 — invalid_role_specification

SQLSTATE 0P000 is invalid_role_specification in Class 0P. Under ENABLE_SSPI, the fixed Windows SSPI path uses it for server LOG branches while converting a SAM account name to a UPN; it is not a generic missing-role login result or a client ErrorResponse.

English manual coverage begins with PostgreSQL 8.1. Source history and runtime observations have their own recorded version boundaries.

Reading PG 18·Select a recorded version

8.1 8.2 8.3 8.4 9.0 9.1 9.2 9.3 9.4 9.5 9.6 10 11 12 13 14 15 16 17 18 19 20

aliases: Unknown
class name: Invalid Role Specification
condition name: invalid_role_specification
lang: en
sqlstate: 0P000

Definition PG 18

0P000

At a glance {#at-a-glance}

SQLSTATE 0P000 is invalid_role_specification in Class 0P. Under ENABLE_SSPI, the fixed Windows SSPI path uses it for server LOG branches while converting a SAM account name to a UPN; it is not a generic missing-role login result or a client ErrorResponse.

Meaning {#meaning}

0P000 is invalid_role_specification. In the fixed pg_SSPI_make_upn path, PostgreSQL builds DOMAIN\user, calls Windows TranslateName to obtain user@realm, and logs 0P000 when translation fails, the result has no @, or the realm/account would not fit the target buffers. These are server LOG branches under ENABLE_SSPI, not a client ErrorResponse and not a generic missing-role result.

Diagnosis {#diagnosis}

Confirm that the failing path is Windows SSPI and inspect the server log together with the SAM account/domain and configured realm or UPN mapping. TranslateName failures (including a result without @) log could not translate name; an oversized realm logs realm name too long, and an oversized translated account logs translated account name too long. A trust-auth disposable target cannot faithfully exercise this external identity boundary; a startup ErrorResponse may instead be 28000 or 28P01.

Response {#response}

Repair the SSPI account/realm mapping or Windows name translation configuration, then establish a new connection. Keep these server-log diagnostics separate from startup authentication responses, SQL role existence, and password failures.

Messages {#messages}

The fixed SSPI source emits LOG with SQLSTATE 0P000 for these primary templates: could not translate name, realm name too long, and translated account name too long. These are server log records; a client exception or startup ErrorResponse without the matching server log is not proof of 0P000.

Representative case {#case}

This page has no selected natural SQL run. The structured evidence records a source or definition boundary; a client-side RAISE would not represent a backend mechanism.

Versions {#versions}

The generated facts table records the locked catalogue snapshots and earliest observed definition. This page has no selected natural SQL run; the fixed REL_18_6/REL_10_23 SSPI source comparison must not be read as an observed runtime result or as a claim about every intermediate release.

Related {#related}

Sources {#sources}

src.auth-name-translation.18.6 — src/backend/libpq/auth.c at REL_18_6 commit 724edf9bde9d356724ad384a2e196edc3c9f80f7; fixed blob SHA-256 94252cb1e2c49b0ddb15f6596d0abf8056c84493de07cc81439da4c5b07018f1 (source).
src.auth-name-translation.10.23 — src/backend/libpq/auth.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61 (source).
src.auth-sspi-upn.10.23 — src/backend/libpq/auth.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61 (source).
src.calls.REL_18_6 / src.calls.REL_10_23 — fixed local call scans, SHA-256 9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf / 00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c; these scans preserve the resolved call context used by the claims.

Compare versions

SQLSTATE evidence and recorded runtime versions

cases · source_boundary

{
  "assertions": [],
  "case_id": "source_boundary",
  "cleanup": "Drop the case schema with an owner connection.",
  "has_snippet": false,
  "position": 0,
  "preconditions": [
    "A runner-owned disposable target is provisioned only if a source-boundary smoke run is requested."
  ],
  "repair": "Use the concrete source path or component-specific documentation when it applies.",
  "trigger": "No artificial SQL trigger is executed; this record preserves the fixed source/definition boundary.",
  "versions": [
    "10",
    "18"
  ]
}

claims · identity.class-and-condition

{
  "claim_id": "identity.class-and-condition",
  "limits": "Directory identity does not identify every backend or client path.",
  "method": "Read the fixed errcodes.txt definition and the locked catalogue metadata.",
  "position": 0,
  "runtime": [],
  "sources": [
    "src.errcodes.18.6"
  ],
  "statement": "0P000 is the invalid_role_specification condition in Class 0P."
}

claims · mechanism.source-boundary

{
  "claim_id": "mechanism.source-boundary",
  "limits": "This is a bounded source claim under ENABLE_SSPI; the disposable trust target cannot faithfully exercise it, and it is not an observed natural SQLSTATE case.",
  "method": "Read the complete fixed SSPI authentication and pg_SSPI_make_upn paths in REL_18_6 and REL_10_23, including each explicit LOG branch.",
  "position": 1,
  "runtime": [],
  "sources": [
    "src.auth-name-translation.18.6",
    "src.auth-name-translation.10.23",
    "src.auth-sspi-upn.10.23"
  ],
  "statement": "Under ENABLE_SSPI, the fixed pg_SSPI_make_upn path builds a DOMAIN\\user SAM name, calls Windows TranslateName to obtain a user@realm UPN, and logs 0P000 when translation fails, the result has no @, or the realm or translated account exceeds its target buffer. These are server LOG branches, not client ErrorResponse fields."
}

claims · versions.catalogue-boundary

{
  "claim_id": "versions.catalogue-boundary",
  "limits": "Presence in a definition file is not an exact behavioral introduction, and the fixed source paths do not prove every intermediate release or authentication configuration.",
  "method": "Read the generated facts block and fixed SSPI source records; no runtime result is used for this source-only page.",
  "position": 2,
  "runtime": [],
  "sources": [
    "src.errcodes.18.6",
    "src.auth-name-translation.18.6",
    "src.auth-sspi-upn.10.23"
  ],
  "statement": "The locked catalogue records 0P000 in the listed snapshots; this page compares only the fixed REL_18_6 and REL_10_23 SSPI source paths and has no selected natural runtime."
}

messages · message.auth-name-translation

{
  "limits": "",
  "message_id": "message.auth-name-translation",
  "path": "",
  "position": 0,
  "raw": {
    "id": "message.auth-name-translation",
    "primary_template": "could not translate name",
    "severity_source": "LOG",
    "sources": [
      "src.auth-name-translation.18.6",
      "src.auth-name-translation.10.23",
      "src.auth-sspi-upn.10.23"
    ],
    "sqlstate": "0P000"
  },
  "severity": "LOG",
  "sources": [
    "src.auth-name-translation.18.6",
    "src.auth-name-translation.10.23",
    "src.auth-sspi-upn.10.23"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "could not translate name",
      "position": 0,
      "role": "",
      "template": "could not translate name"
    }
  ]
}

messages · message.auth-sspi-realm-too-long

{
  "limits": "",
  "message_id": "message.auth-sspi-realm-too-long",
  "path": "",
  "position": 1,
  "raw": {
    "id": "message.auth-sspi-realm-too-long",
    "primary_template": "realm name too long",
    "severity_source": "explicit LOG",
    "sources": [
      "src.auth-sspi-upn.10.23"
    ],
    "sqlstate": "0P000"
  },
  "severity": "explicit LOG",
  "sources": [
    "src.auth-sspi-upn.10.23"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "realm name too long",
      "position": 0,
      "role": "",
      "template": "realm name too long"
    }
  ]
}

messages · message.auth-sspi-account-too-long

{
  "limits": "",
  "message_id": "message.auth-sspi-account-too-long",
  "path": "",
  "position": 2,
  "raw": {
    "id": "message.auth-sspi-account-too-long",
    "primary_template": "translated account name too long",
    "severity_source": "explicit LOG",
    "sources": [
      "src.auth-sspi-upn.10.23"
    ],
    "sqlstate": "0P000"
  },
  "severity": "explicit LOG",
  "sources": [
    "src.auth-sspi-upn.10.23"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "translated account name too long",
      "position": 0,
      "role": "",
      "template": "translated account name too long"
    }
  ]
}

sources · src.errcodes.18.6

{
  "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "src/backend/utils/errcodes.txt",
  "position": 0,
  "sha256": "6e8de346643ba84aa3c9c6a73360acfc7b2dfb89162c06c08ce9bf5bcd5bbcba",
  "source_id": "src.errcodes.18.6",
  "tag": "REL_18_6",
  "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/utils/errcodes.txt"
}

sources · src.calls.REL_18_6

{
  "commit": "",
  "docs_url": "",
  "kind": "local_artifact",
  "location": "",
  "path": "raw/calls/REL_18_6.jsonl",
  "position": 1,
  "sha256": "9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf",
  "source_id": "src.calls.REL_18_6",
  "tag": "REL_18_6",
  "url": ""
}

sources · src.calls.REL_10_23

{
  "commit": "",
  "docs_url": "",
  "kind": "local_artifact",
  "location": "",
  "path": "raw/calls/REL_10_23.jsonl",
  "position": 2,
  "sha256": "00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c",
  "source_id": "src.calls.REL_10_23",
  "tag": "REL_10_23",
  "url": ""
}

sources · src.auth-name-translation.18.6

{
  "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "src/backend/libpq/auth.c",
  "position": 3,
  "sha256": "94252cb1e2c49b0ddb15f6596d0abf8056c84493de07cc81439da4c5b07018f1",
  "source_id": "src.auth-name-translation.18.6",
  "tag": "REL_18_6",
  "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/libpq/auth.c#L1514-L1516"
}

sources · src.auth-name-translation.10.23

{
  "commit": "02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "src/backend/libpq/auth.c",
  "position": 4,
  "sha256": "15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61",
  "source_id": "src.auth-name-translation.10.23",
  "tag": "REL_10_23",
  "url": "https://github.com/postgres/postgres/blob/02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4/src/backend/libpq/auth.c#L1699-L1701"
}

sources · src.auth-sspi-upn.10.23

{
  "commit": "02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "src/backend/libpq/auth.c",
  "position": 5,
  "sha256": "15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61",
  "source_id": "src.auth-sspi-upn.10.23",
  "tag": "REL_10_23",
  "url": "https://github.com/postgres/postgres/blob/02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4/src/backend/libpq/auth.c#L1666-L1758"
}

sources · manifest.0P000

{
  "commit": "",
  "docs_url": "",
  "kind": "local_artifact",
  "location": "",
  "path": "verify/cases/0P000/cases.json",
  "position": 6,
  "sha256": "2460d980be19d06e88766a7907f6f3a301ae4786dcab8c019736a904116aadc4",
  "source_id": "manifest.0P000",
  "tag": "workspace",
  "url": "verify/cases/0P000/cases.json"
}

Source references

Original manual reference

Full definition and evidence JSON

Definition sources

center · PostgreSQL 18 · english-manuals:b11b2ee2355ba4563d32ab458ec76cfcacc50f2d295a1f03001d1e560698cc19

Text language: en · english-manuals:b11b2ee2355ba4563d32ab458ec76cfcacc50f2d295a1f03001d1e560698cc19