2F003 — prohibited_sql_statement_attempted

The fixed scan confirms this ERROR in both dblink and postgres_fdw connection paths. dblink also reports it when a command would return rows where the dblink API expects no result. The authentication variants are wrapper/connection policy paths, not proof that every prohibited SQL statement uses this code.

English manual coverage begins with PostgreSQL 8.1. Source history and runtime observations have their own recorded version boundaries.

Reading PG 18·Select a recorded version

8.1 8.2 8.3 8.4 9.0 9.1 9.2 9.3 9.4 9.5 9.6 10 11 12 13 14 15 16 17 18 19 20

aliases: Unknown
class name: SQL Routine Exception
condition name: prohibited_sql_statement_attempted
lang: en
sqlstate: 2F003

Definition PG 18

2F003

At a glance {#at-a-glance}

Meaning {#meaning}

The confirmed messages include statement returning results not allowed, and authentication variants such as password or GSSAPI delegated credentials required with a detail and sometimes a hint. postgres_fdw adds detail about the user mapping and may hint at password_required=false; dblink has its own credential wording. Keep the producer because the same SQLSTATE covers separate APIs.

Messages {#messages}

Confirmed messages include statement returning results not allowed, plus password or GSSAPI delegated credentials required, which carries detail and may also carry a hint depending on the path. postgres_fdw identifies the user mapping in its detail and one path mentions password_required=false in the hint; dblink uses its own credential wording. Because the same SQLSTATE covers separate APIs, retain the actual producer.

Diagnosis {#diagnosis}

For dblink, identify whether the local call is a row-returning command used through a no-result API or a connection credential check. For postgres_fdw, inspect the foreign-server connection, user mapping, authentication method, and the server’s password_required policy when the message names them. Preserve the fixed detail/hint and do not collapse dblink and postgres_fdw into one generic wrapper.

Response {#response}

Correct the command/API pairing or the named connection credentials and user mapping, then verify the remote operation. A remote connection attempt may not have completed; preserve the remote/local boundary before retrying. Do not change transaction policy merely because dblink or postgres_fdw reported 2F003.

Versions {#versions}

The locked catalogue places this condition at least by PostgreSQL 7.4. The facts block lists the published snapshots; source-path status is limited to the fixed PostgreSQL 18.6 evidence below.

Related {#related}

2F000, 38003

Sources {#sources}

Read the fixed dblink.c and postgres_fdw connection.c paths alongside the structured evidence record.

Compare versions

SQLSTATE evidence and recorded runtime versions

claims · identity

{
  "claim_id": "identity",
  "limits": "",
  "method": "Read the fixed errcodes definition row, severity, and macro.",
  "position": 0,
  "runtime": [],
  "sources": [
    "src.errcodes.18.6"
  ],
  "statement": "2F003 is prohibited_sql_statement_attempted in SQLSTATE Class 2F."
}

claims · resolved-path

{
  "claim_id": "resolved-path",
  "limits": "Source confirmation is not a runtime observation in this batch.",
  "method": "Read the complete source context around the resolved report groups.",
  "position": 1,
  "runtime": [],
  "sources": [
    "src.path.0",
    "src.path.1"
  ],
  "statement": "The fixed PostgreSQL 18.6 source contains the report contexts and message variants described on the page."
}

claims · history-boundary

{
  "claim_id": "history-boundary",
  "limits": "Definition presence is not an emitting-path observation.",
  "method": "Compare canonical release facts with the available history boundary.",
  "position": 2,
  "runtime": [],
  "sources": [
    "src.errcodes.18.6"
  ],
  "statement": "Locked release definitions establish catalogue presence from 7.4; they do not establish a precise introducing release or runtime use."
}

messages · message.dblink-results-not-allowed

{
  "limits": "This is dblink no-result API enforcement.",
  "message_id": "message.dblink-results-not-allowed",
  "path": "",
  "position": 0,
  "raw": {
    "id": "message.dblink-results-not-allowed",
    "limits": "This is dblink no-result API enforcement.",
    "primary_template": "statement returning results not allowed",
    "severity_source": "ERROR",
    "sources": [
      "src.path.0"
    ],
    "sqlstate": "2F003"
  },
  "severity": "ERROR",
  "sources": [
    "src.path.0"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "statement returning results not allowed",
      "position": 0,
      "role": "",
      "template": "statement returning results not allowed"
    }
  ]
}

messages · message.dblink-credentials-with-hint

{
  "limits": "Credential wording and whether HINT is present vary by dblink connection path.",
  "message_id": "message.dblink-credentials-with-hint",
  "path": "",
  "position": 1,
  "raw": {
    "detail_template": "Non-superusers may only connect using credentials they provide, eg: password in connection string or delegated GSSAPI credentials",
    "hint_template": "Ensure provided credentials match target server's authentication method.",
    "id": "message.dblink-credentials-with-hint",
    "limits": "Credential wording and whether HINT is present vary by dblink connection path.",
    "primary_template": "password or GSSAPI delegated credentials required",
    "severity_source": "ERROR",
    "sources": [
      "src.path.0"
    ],
    "sqlstate": "2F003"
  },
  "severity": "ERROR",
  "sources": [
    "src.path.0"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "password or GSSAPI delegated credentials required",
      "position": 0,
      "role": "",
      "template": "password or GSSAPI delegated credentials required"
    },
    {
      "kind": "detail",
      "literal": "Non-superusers may only connect using credentials they provide, eg: password in connection string or delegated GSSAPI credentials",
      "position": 1,
      "role": "",
      "template": "Non-superusers may only connect using credentials they provide, eg: password in connection string or delegated GSSAPI credentials"
    },
    {
      "kind": "hint",
      "literal": "Ensure provided credentials match target server's authentication method.",
      "position": 2,
      "role": "",
      "template": "Ensure provided credentials match target server's authentication method."
    }
  ]
}

messages · message.dblink-credentials-no-hint

{
  "limits": "This dblink credential branch has DETAIL but no HINT.",
  "message_id": "message.dblink-credentials-no-hint",
  "path": "",
  "position": 2,
  "raw": {
    "detail_template": "Non-superusers must provide a password in the connection string or send delegated GSSAPI credentials.",
    "id": "message.dblink-credentials-no-hint",
    "limits": "This dblink credential branch has DETAIL but no HINT.",
    "primary_template": "password or GSSAPI delegated credentials required",
    "severity_source": "ERROR",
    "sources": [
      "src.path.0"
    ],
    "sqlstate": "2F003"
  },
  "severity": "ERROR",
  "sources": [
    "src.path.0"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "password or GSSAPI delegated credentials required",
      "position": 0,
      "role": "",
      "template": "password or GSSAPI delegated credentials required"
    },
    {
      "kind": "detail",
      "literal": "Non-superusers must provide a password in the connection string or send delegated GSSAPI credentials.",
      "position": 1,
      "role": "",
      "template": "Non-superusers must provide a password in the connection string or send delegated GSSAPI credentials."
    }
  ]
}

messages · message.postgres-fdw-password-required

{
  "limits": "User mapping, authentication method, and password_required setting are deployment-dependent.",
  "message_id": "message.postgres-fdw-password-required",
  "path": "",
  "position": 3,
  "raw": {
    "detail_template": "Non-superuser cannot connect if the server does not request a password or use GSSAPI with delegated credentials.",
    "hint_template": "Target server's authentication method must be changed or password_required=false set in the user mapping attributes.",
    "id": "message.postgres-fdw-password-required",
    "limits": "User mapping, authentication method, and password_required setting are deployment-dependent.",
    "primary_template": "password or GSSAPI delegated credentials required",
    "severity_source": "ERROR",
    "sources": [
      "src.path.1"
    ],
    "sqlstate": "2F003"
  },
  "severity": "ERROR",
  "sources": [
    "src.path.1"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "password or GSSAPI delegated credentials required",
      "position": 0,
      "role": "",
      "template": "password or GSSAPI delegated credentials required"
    },
    {
      "kind": "detail",
      "literal": "Non-superuser cannot connect if the server does not request a password or use GSSAPI with delegated credentials.",
      "position": 1,
      "role": "",
      "template": "Non-superuser cannot connect if the server does not request a password or use GSSAPI with delegated credentials."
    },
    {
      "kind": "hint",
      "literal": "Target server's authentication method must be changed or password_required=false set in the user mapping attributes.",
      "position": 2,
      "role": "",
      "template": "Target server's authentication method must be changed or password_required=false set in the user mapping attributes."
    }
  ]
}

messages · message.postgres-fdw-scram-pass-through

{
  "limits": "This branch has DETAIL and no HINT.",
  "message_id": "message.postgres-fdw-scram-pass-through",
  "path": "",
  "position": 4,
  "raw": {
    "detail_template": "Non-superusers must delegate GSSAPI credentials, provide a password, or enable SCRAM pass-through in user mapping.",
    "id": "message.postgres-fdw-scram-pass-through",
    "limits": "This branch has DETAIL and no HINT.",
    "primary_template": "password or GSSAPI delegated credentials required",
    "severity_source": "ERROR",
    "sources": [
      "src.path.1"
    ],
    "sqlstate": "2F003"
  },
  "severity": "ERROR",
  "sources": [
    "src.path.1"
  ],
  "templates": [
    {
      "kind": "primary",
      "literal": "password or GSSAPI delegated credentials required",
      "position": 0,
      "role": "",
      "template": "password or GSSAPI delegated credentials required"
    },
    {
      "kind": "detail",
      "literal": "Non-superusers must delegate GSSAPI credentials, provide a password, or enable SCRAM pass-through in user mapping.",
      "position": 1,
      "role": "",
      "template": "Non-superusers must delegate GSSAPI credentials, provide a password, or enable SCRAM pass-through in user mapping."
    }
  ]
}

sources · src.errcodes.18.6

{
  "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "src/backend/utils/errcodes.txt",
  "position": 0,
  "sha256": "6e8de346643ba84aa3c9c6a73360acfc7b2dfb89162c06c08ce9bf5bcd5bbcba",
  "source_id": "src.errcodes.18.6",
  "tag": "REL_18_6",
  "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/utils/errcodes.txt#L291"
}

sources · src.path.0

{
  "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "contrib/dblink/dblink.c",
  "position": 1,
  "sha256": "e4cfaec3a0a1e5d23fded584725e0f6cf7a17321ad99e5fe046e8b7f97416f15",
  "source_id": "src.path.0",
  "tag": "REL_18_6",
  "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/contrib/dblink/dblink.c#L1488"
}

sources · src.path.1

{
  "commit": "724edf9bde9d356724ad384a2e196edc3c9f80f7",
  "docs_url": "",
  "kind": "upstream_source",
  "location": "",
  "path": "contrib/postgres_fdw/connection.c",
  "position": 2,
  "sha256": "67fc002657f2c7df6d93cbf99c933cbc103907d1857ed77aedbb85099ea4dda0",
  "source_id": "src.path.1",
  "tag": "REL_18_6",
  "url": "https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/contrib/postgres_fdw/connection.c#L756"
}

sources · src.calls.REL_18_6

{
  "commit": "",
  "docs_url": "",
  "kind": "local_artifact",
  "location": "",
  "path": "raw/calls/REL_18_6.jsonl",
  "position": 3,
  "sha256": "9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf",
  "source_id": "src.calls.REL_18_6",
  "tag": "",
  "url": ""
}

Source references

Original manual reference

Full definition and evidence JSON

Definition sources

center · PostgreSQL 18 · english-manuals:38f3e76e1145418e772fc5c4c480ef60a1136f9ab451136c0a9fd2ece756332a

Text language: en · english-manuals:38f3e76e1145418e772fc5c4c480ef60a1136f9ab451136c0a9fd2ece756332a