Version: Next

pg_authid

The pg_authid table in the pg_catalog schema contains information about database authorization identifiers (roles). A role subsumes the concepts of users and groups. A user is a role with the rolcanlogin flag set. Any role (with or without rolcanlogin) might have other roles as members. See pg_auth_members.

Because this catalog contains passwords, it must not be publicly readable. pg_roles is a publicly readable view on pg_authid that blanks out the password field.

Because user identities are system-wide, pg_authid is shared across all databases in a Apache Cloudberry system: there is only one copy of pg_authid per system, not one per database.

column	type	description
`oid`	oid	Row identifier
`rolname`	name	Role name
`rolsuper`	boolean	Role has superuser privileges
`rolinherit`	boolean	Role automatically inherits privileges of roles it is a member of
`rolcreaterole`	boolean	Role might create more roles
`rolcreatedb`	boolean	Role might create databases
`rolcanlogin`	boolean	Role might log in. That is, this role can be given as the initial session authorization identifier
`rolreplication`	boolean	Role is a replication role. That is, this role can initiate streaming replication and set/unset the system backup mode using `pg_start_backup` and `pg_stop_backup`.
`rolbypassrls`	boolean	Roles bypasses every row-level security policy.
`rolconnlimit`	int4	For roles that can log in, this sets maximum number of concurrent connections this role can make. `-1` means no limit
`rolenableprofile`	`boolean`	Role has a profile.
`rolpassword`	text	Password (possibly encrypted); NULL if none. If the password is encrypted, this column will begin with the string `md5` followed by a 32-character hexadecimal MD5 hash. The MD5 hash will be the user's password concatenated to their user name. For example, if user `joe` has password `xyzzy`, Apache Cloudberry will store the md5 hash of `xyzzyjoe`. Apache Cloudberry assumes that a password that does not follow that format is unencrypted.
`rolvaliduntil`	timestamptz	Password expiry time (only used for password authentication); NULL if no expiration
`rolprofile`	`oid`	Object ID of the associated profile ID in `pg_profile`
`rolaccountstatus`	smallint	Account status of the role.
`rolfailedlogins`	integer	Number of failed login attempts.
`rolpasswordsetat`	timestamptz	Time when the password was last set.
`rollockdate`	timestamptz	Time when the role was locked.
`rolpasswordexpire`	timestamptz	Time when the password will expire.
`rolresqueue`	oid	Object ID of the associated resource queue ID in `pg_resqueue`
`rolcreaterextgpfd`	boolean	Privilege to create read external tables with the `gpfdist` or `gpfdists` protocol
`rolcreaterexhttp`	boolean	Privilege to create read external tables with the `http` protocol
`rolcreatewextgpfd`	boolean	Privilege to create write external tables with the `gpfdist` or `gpfdists` protocol
`rolresgroup`	oid	Object ID of the associated resource group ID in `pg_resgroup`