Postgresql 中文操作指南
53.8. pg_authid #
目录 pg_authid 包含有关数据库授权标识符（角色）的信息。角色包含了“用户”和“组”的概念。用户本质上只是一组 rolcanlogin 标志已设置的角色。任何角色（无论是否有 rolcanlogin ）都可以有其他角色作为成员；请参见 pg_auth_members 。
The catalog pg_authid contains information about database authorization identifiers (roles). A role subsumes the concepts of “users” and “groups”. A user is essentially just a role with the rolcanlogin flag set. Any role (with or without rolcanlogin) can have other roles as members; see pg_auth_members.
由于此目录包含密码，因此它不能公开读取。 pg_roles 是 pg_authid 中一个可公开读取的视图，其中将密码字段留空。
Since this catalog contains passwords, it must not be publicly readable. pg_roles is a publicly readable view on pg_authid that blanks out the password field.
Chapter 22提供了有关用户和权限管理的详细信息。
Chapter 22 contains detailed information about user and privilege management.
由于用户标识在整个集群，pg_authid 在集群的所有数据库中共享：每个集群只有一份 pg_authid，而不是每个数据库一份。
Because user identities are cluster-wide, pg_authid is shared across all databases of a cluster: there is only one copy of pg_authid per cluster, not one per database.
Table 53.8. pg_authid Columns
Table 53.8. pg_authid Columns
Column Type Description |
oid oid Row identifier |
rolname name Role name |
rolsuper bool Role has superuser privileges |
rolinherit bool Role automatically inherits privileges of roles it is a member of |
rolcreaterole bool Role can create more roles |
rolcreatedb bool Role can create databases |
rolcanlogin bool Role can log in. That is, this role can be given as the initial session authorization identifier. |
rolreplication bool Role is a replication role. A replication role can initiate replication connections and create and drop replication slots. |
rolbypassrls bool Role bypasses every row-level security policy, see Section 5.8 for more information. |
rolconnlimit int4 For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit. |
rolpassword text Password (possibly encrypted); null if none. The format depends on the form of encryption used. |
rolvaliduntil timestamptz Password expiry time (only used for password authentication); null if no expiration |
对于一个 MD5 加密密码，rolpassword 列将用字符串 md5 开头，后跟一个 32 位十六进制 MD5 哈希。MD5 哈希将是用户的合并后密码与其用户名。例如，如果用户 joe 有密码 xyzzy，PostgreSQL 将存储 xyzzyjoe 的 MD5 哈希。
For an MD5 encrypted password, rolpassword column will begin with the string md5 followed by a 32-character hexadecimal MD5 hash. The MD5 hash will be of the user’s password concatenated to their user name. For example, if user joe has password xyzzy, PostgreSQL will store the md5 hash of xyzzyjoe.
如果使用 SCRAM-SHA-256 加密密码，则其格式为：
If the password is encrypted with SCRAM-SHA-256, it has the format:
SCRAM-SHA-256$<iteration count>:<salt>$<StoredKey>:<ServerKey>其中 salt、_StoredKey_和 _ServerKey_都采用 Base64 编码格式。此格式与 RFC 5803指定的格式相同。
where salt, StoredKey and ServerKey are in Base64 encoded format. This format is the same as that specified by RFC 5803.
假设不符合这两种格式的密码是未加密的密码。
A password that does not follow either of those formats is assumed to be unencrypted.