Supported Versions: Current (16) / 15 / 14 / 13 / 12
Development Versions: devel
Unsupported versions: 11 / 10 / 9.6 / 9.5 / 9.4 / 9.3 / 9.2 / 9.1 / 9.0 / 8.4 / 8.3 / 8.2 / 8.1
This documentation is for an unsupported version of PostgreSQL.
You may want to view the same page for the current version, or one of the other supported versions listed above instead.

43.8. pg_authid

The catalog pg_authid contains information about database authorization identifiers (roles). A role subsumes the concepts of "users" and "groups". A user is essentially just a role with the rolcanlogin flag set. Any role (with or without rolcanlogin) may have other roles as members; see pg_auth_members.

Since this catalog contains passwords, it must not be publicly readable. pg_roles is a publicly readable view on pg_authid that blanks out the password field.

Chapter 18 contains detailed information about user and privilege management.

Because user identities are cluster-wide, pg_authid is shared across all databases of a cluster: there is only one copy of pg_authid per cluster, not one per database.

Table 43-8. pg_authid Columns

Name Type Description  
rolname name Role name  
rolsuper bool Role has superuser privileges  
rolinherit bool Role automatically inherits privileges of roles it is a member of  
rolcreaterole bool Role may create more roles  
rolcreatedb bool Role may create databases  
rolcatupdate bool Role may update system catalogs directly. (Even a superuser may not do this unless this column is true)  
rolcanlogin bool Role may log in. That is, this role can be given as the initial session authorization identifier  
rolconnlimit int4 For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit  
rolpassword text Password (possibly encrypted); NULL if none  
rolvaliduntil timestamptz Password expiry time (only used for password authentication); NULL if no expiration  
rolconfig text[] Session defaults for run-time configuration variables