1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
|
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>CREATE ROLE</title>
<link rel="stylesheet" href="stylesheet.css" type="text/css">
<link rev="made" href="pgsql-docs@postgresql.org">
<meta name="generator" content="DocBook XSL Stylesheets V1.70.0">
<link rel="start" href="index.html" title="PostgreSQL 8.1.4 Documentation">
<link rel="up" href="sql-commands.html" title="SQL Commands">
<link rel="prev" href="sql-createopclass.html" title="CREATE OPERATOR CLASS">
<link rel="next" href="sql-createrule.html" title="CREATE RULE">
<link rel="copyright" href="ln-legalnotice.html" title="Legal Notice">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
<a name="sql-createrole"></a><div class="titlepage"></div>
<div class="refnamediv">
<h2>Name</h2>
<p>CREATE ROLE — define a new database role</p>
</div>
<a name="id758995"></a><div class="refsynopsisdiv">
<h2>Synopsis</h2>
<pre class="synopsis">CREATE ROLE <em class="replaceable"><code>name</code></em> [ [ WITH ] <em class="replaceable"><code>option</code></em> [ ... ] ]
where <em class="replaceable"><code>option</code></em> can be:
SUPERUSER | NOSUPERUSER
| CREATEDB | NOCREATEDB
| CREATEROLE | NOCREATEROLE
| CREATEUSER | NOCREATEUSER
| INHERIT | NOINHERIT
| LOGIN | NOLOGIN
| CONNECTION LIMIT <em class="replaceable"><code>connlimit</code></em>
| [ ENCRYPTED | UNENCRYPTED ] PASSWORD '<em class="replaceable"><code>password</code></em>'
| VALID UNTIL '<em class="replaceable"><code>timestamp</code></em>'
| IN ROLE <em class="replaceable"><code>rolename</code></em> [, ...]
| IN GROUP <em class="replaceable"><code>rolename</code></em> [, ...]
| ROLE <em class="replaceable"><code>rolename</code></em> [, ...]
| ADMIN <em class="replaceable"><code>rolename</code></em> [, ...]
| USER <em class="replaceable"><code>rolename</code></em> [, ...]
| SYSID <em class="replaceable"><code>uid</code></em> </pre>
</div>
<div class="refsect1" lang="en">
<a name="id759098"></a><h2>Description</h2>
<p> <code class="command">CREATE ROLE</code> adds a new role to a
<span class="productname">PostgreSQL</span> database cluster. A role is
an entity that can own database objects and have database privileges;
a role can be considered a “<span class="quote">user</span>”, a “<span class="quote">group</span>”, or both
depending on how it is used. Refer to
<a href="user-manag.html" title="Chapter18.Database Roles and Privileges">Chapter18, <i>Database Roles and Privileges</i></a> and <a href="client-authentication.html" title="Chapter20.Client Authentication">Chapter20, <i>Client Authentication</i></a> for information about managing
users and authentication. You must have <code class="literal">CREATEROLE</code>
privilege or be a database superuser to use this command.
</p>
<p> Note that roles are defined at the database cluster
level, and so are valid in all databases in the cluster.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id759157"></a><h2>Parameters</h2>
<div class="variablelist"><dl>
<dt><span class="term"><em class="replaceable"><code>name</code></em></span></dt>
<dd><p> The name of the new role.
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">SUPERUSER</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">NOSUPERUSER</code></span>
</dt>
<dd><p> These clauses determine whether the new role is a “<span class="quote">superuser</span>”,
who can override all access restrictions within the database.
Superuser status is dangerous and should be used only when really
needed. You must yourself be a superuser to create a new superuser.
If not specified,
<code class="literal">NOSUPERUSER</code> is the default.
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">CREATEDB</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">NOCREATEDB</code></span>
</dt>
<dd><p> These clauses define a role's ability to create databases. If
<code class="literal">CREATEDB</code> is specified, the role being
defined will be allowed to create new databases. Specifying
<code class="literal">NOCREATEDB</code> will deny a role the ability to
create databases. If not specified,
<code class="literal">NOCREATEDB</code> is the default.
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">CREATEROLE</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">NOCREATEROLE</code></span>
</dt>
<dd><p> These clauses determine whether a role will be permitted to
create new roles (that is, execute <code class="command">CREATE ROLE</code>).
A role with <code class="literal">CREATEROLE</code> privilege can also alter
and drop other roles.
If not specified,
<code class="literal">NOCREATEROLE</code> is the default.
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">CREATEUSER</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">NOCREATEUSER</code></span>
</dt>
<dd><p> These clauses are an obsolete, but still accepted, spelling of
<code class="literal">SUPERUSER</code> and <code class="literal">NOSUPERUSER</code>.
Note that they are <span class="emphasis"><em>not</em></span> equivalent to
<code class="literal">CREATEROLE</code> as one might naively expect!
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">INHERIT</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">NOINHERIT</code></span>
</dt>
<dd><p> These clauses determine whether a role “<span class="quote">inherits</span>” the
privileges of roles it is a member of.
A role with the <code class="literal">INHERIT</code> attribute can automatically
use whatever database privileges have been granted to all roles
it is directly or indirectly a member of.
Without <code class="literal">INHERIT</code>, membership in another role
only grants the ability to <code class="command">SET ROLE</code> to that other role;
the privileges of the other role are only available after having
done so.
If not specified,
<code class="literal">INHERIT</code> is the default.
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">LOGIN</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">NOLOGIN</code></span>
</dt>
<dd><p> These clauses determine whether a role is allowed to log in;
that is, whether the role can be given as the initial session
authorization name during client connection. A role having
the <code class="literal">LOGIN</code> attribute can be thought of as a user.
Roles without this attribute are useful for managing database
privileges, but are not users in the usual sense of the word.
If not specified,
<code class="literal">NOLOGIN</code> is the default, except when
<code class="command">CREATE ROLE</code> is invoked through its alternate spelling
<code class="command">CREATE USER</code>.
</p></dd>
<dt><span class="term"><code class="literal">CONNECTION LIMIT</code> <em class="replaceable"><code>connlimit</code></em></span></dt>
<dd><p> If role can log in, this specifies how many concurrent connections
the role can make. -1 (the default) means no limit.
</p></dd>
<dt><span class="term"><code class="literal">PASSWORD</code> <em class="replaceable"><code>password</code></em></span></dt>
<dd><p> Sets the role's password. (A password is only of use for
roles having the <code class="literal">LOGIN</code> attribute, but you can
nonetheless define one for roles without it.)
If you do not plan to use password
authentication you can omit this option.
</p></dd>
<dt>
<span xmlns="http://www.w3.org/TR/xhtml1/transitional" class="term"><code xmlns="" class="literal">ENCRYPTED</code></span><br xmlns="http://www.w3.org/TR/xhtml1/transitional"></br><span class="term"><code class="literal">UNENCRYPTED</code></span>
</dt>
<dd>
<p> These key words control whether the password is stored
encrypted in the system catalogs. (If neither is specified,
the default behavior is determined by the configuration
parameter <a href="runtime-config-connection.html#guc-password-encryption">password_encryption</a>.) If the
presented password string is already in MD5-encrypted format,
then it is stored encrypted as-is, regardless of whether
<code class="literal">ENCRYPTED</code> or <code class="literal">UNENCRYPTED</code> is specified
(since the system cannot decrypt the specified encrypted
password string). This allows reloading of encrypted
passwords during dump/restore.
</p>
<p> Note that older clients may lack support for the MD5
authentication mechanism that is needed to work with passwords
that are stored encrypted.
</p>
</dd>
<dt><span class="term"><code class="literal">VALID UNTIL</code> '<em class="replaceable"><code>timestamp</code></em>'</span></dt>
<dd><p> The <code class="literal">VALID UNTIL</code> clause sets a date and
time after which the role's password is no longer valid. If
this clause is omitted the password will be valid for all time.
</p></dd>
<dt><span class="term"><code class="literal">IN ROLE</code> <em class="replaceable"><code>rolename</code></em></span></dt>
<dd><p> The <code class="literal">IN ROLE</code> clause lists one or more existing
roles to which the new role will be immediately added as a new
member. (Note that there is no option to add the new role as an
administrator; use a separate <code class="command">GRANT</code> command to do that.)
</p></dd>
<dt><span class="term"><code class="literal">IN GROUP</code> <em class="replaceable"><code>rolename</code></em></span></dt>
<dd><p> <code class="literal">IN GROUP</code> is an obsolete spelling of
<code class="literal">IN ROLE</code>.
</p></dd>
<dt><span class="term"><code class="literal">ROLE</code> <em class="replaceable"><code>rolename</code></em></span></dt>
<dd><p> The <code class="literal">ROLE</code> clause lists one or more existing
roles which are automatically added as members of the new role.
(This in effect makes the new role a “<span class="quote">group</span>”.)
</p></dd>
<dt><span class="term"><code class="literal">ADMIN</code> <em class="replaceable"><code>rolename</code></em></span></dt>
<dd><p> The <code class="literal">ADMIN</code> clause is like <code class="literal">ROLE</code>,
but the named roles are added to the new role <code class="literal">WITH ADMIN
OPTION</code>, giving them the right to grant membership in this role
to others.
</p></dd>
<dt><span class="term"><code class="literal">USER</code> <em class="replaceable"><code>rolename</code></em></span></dt>
<dd><p> The <code class="literal">USER</code> clause is an obsolete spelling of
the <code class="literal">ROLE</code> clause.
</p></dd>
<dt><span class="term"><code class="literal">SYSID</code> <em class="replaceable"><code>uid</code></em></span></dt>
<dd><p> The <code class="literal">SYSID</code> clause is ignored, but is accepted
for backwards compatibility.
</p></dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
<a name="id759774"></a><h2>Notes</h2>
<p> Use <a href="sql-alterrole.html">ALTER ROLE</a> to
change the attributes of a role, and <a href="sql-droprole.html">DROP ROLE</a> to remove a role. All the attributes
specified by <code class="command">CREATE ROLE</code> can be modified by later
<code class="command">ALTER ROLE</code> commands.
</p>
<p> The preferred way to add and remove members of roles that are being
used as groups is to use
<a href="sql-grant.html">GRANT</a> and
<a href="sql-revoke.html">REVOKE</a>.
</p>
<p> The <code class="literal">VALID UNTIL</code> clause defines an expiration time for a
password only, not for the role <span class="foreignphrase"><em class="foreignphrase">per se</em></span>. In
particular, the expiration time is not enforced when logging in using
a non-password-based authentication method.
</p>
<p> The <code class="literal">INHERIT</code> attribute governs inheritance of grantable
privileges (that is, access privileges for database objects and role
memberships). It does not apply to the special role attributes set by
<code class="command">CREATE ROLE</code> and <code class="command">ALTER ROLE</code>. For example, being
a member of a role with <code class="literal">CREATEDB</code> privilege does not immediately
grant the ability to create databases, even if <code class="literal">INHERIT</code> is set;
it would be necessary to become that role via
<a href="sql-set-role.html">SET ROLE</a> before
creating a database.
</p>
<p> The <code class="literal">INHERIT</code> attribute is the default for reasons of backwards
compatibility: in prior releases of <span class="productname">PostgreSQL</span>,
users always had access to all privileges of groups they were members of.
However, <code class="literal">NOINHERIT</code> provides a closer match to the semantics
specified in the SQL standard.
</p>
<p> Be careful with the <code class="literal">CREATEROLE</code> privilege. There is no concept of
inheritance for the privileges of a <code class="literal">CREATEROLE</code>-role. That
means that even if a role does not have a certain privilege but is allowed
to create other roles, it can easily create another role with different
privileges than its own (except for creating roles with superuser
privileges). For example, if the role “<span class="quote">user</span>” has the
<code class="literal">CREATEROLE</code> privilege but not the <code class="literal">CREATEDB</code> privilege,
nonetheless it can create a new role with the <code class="literal">CREATEDB</code>
privilege. Therefore, regard roles that have the <code class="literal">CREATEROLE</code>
privilege as almost-superuser-roles.
</p>
<p> <span class="productname">PostgreSQL</span> includes a program <a href="app-createuser.html"><span class="application">createuser</span></a> that has
the same functionality as <code class="command">CREATE ROLE</code> (in fact,
it calls this command) but can be run from the command shell.
</p>
<p> The <code class="literal">CONNECTION LIMIT</code> option is only enforced approximately;
if two new sessions start at about the same time when just one
connection “<span class="quote">slot</span>” remains for the role, it is possible that
both will fail. Also, the limit is never enforced for superusers.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id760043"></a><h2>Examples</h2>
<p> Create a role that can log in, but don't give it a password:
</p>
<pre class="programlisting">CREATE ROLE jonathan LOGIN;</pre>
<p>
</p>
<p> Create a role with a password:
</p>
<pre class="programlisting">CREATE USER davide WITH PASSWORD 'jw8s0F4';</pre>
<p>
(<code class="command">CREATE USER</code> is the same as <code class="command">CREATE ROLE</code> except
that it implies <code class="literal">LOGIN</code>.)
</p>
<p> Create a role with a password that is valid until the end of 2004.
After one second has ticked in 2005, the password is no longer
valid.
</p>
<pre class="programlisting">CREATE ROLE miriam WITH LOGIN PASSWORD 'jw8s0F4' VALID UNTIL '2005-01-01';</pre>
<p>
</p>
<p>
Create a role that can create databases and manage roles:
</p>
<pre class="programlisting">CREATE ROLE admin WITH CREATEDB CREATEROLE;</pre>
<p>
</p>
</div>
<div class="refsect1" lang="en">
<a name="id760112"></a><h2>Compatibility</h2>
<p> The <code class="command">CREATE ROLE</code> statement is in the SQL standard,
but the standard only requires the syntax
</p>
<pre class="synopsis">CREATE ROLE <em class="replaceable"><code>name</code></em> [ WITH ADMIN <em class="replaceable"><code>rolename</code></em> ]</pre>
<p>
Multiple initial administrators, and all the other options of
<code class="command">CREATE ROLE</code>, are
<span class="productname">PostgreSQL</span> extensions.
</p>
<p> The SQL standard defines the concepts of users and roles, but it
regards them as distinct concepts and leaves all commands defining
users to be specified by each database implementation. In
<span class="productname">PostgreSQL</span> we have chosen to unify
users and roles into a single kind of entity. Roles therefore
have many more optional attributes than they do in the standard.
</p>
<p> The behavior specified by the SQL standard is most closely approximated
by giving users the <code class="literal">NOINHERIT</code> attribute, while roles are
given the <code class="literal">INHERIT</code> attribute.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id760195"></a><h2>See Also</h2>
<span class="simplelist"><a href="sql-set-role.html">SET ROLE</a>, <a href="sql-alterrole.html">ALTER ROLE</a>, <a href="sql-droprole.html">DROP ROLE</a>, <a href="sql-grant.html">GRANT</a>, <a href="sql-revoke.html">REVOKE</a>, <a href="app-createuser.html" title="createuser"><span class="refentrytitle"><a name="app-createuser-title"></a><span class="application">createuser</span></span></a></span>
</div>
</div></body>
</html>
|
