ALTER ROLE
ALTER ROLE — Change a Database Role
Synopsis
ALTER ROLE role_specification [ WITH ] option [ ... ]
where option can be:
SUPERUSER | NOSUPERUSER
| CREATEDB | NOCREATEDB
| CREATEROLE | NOCREATEROLE
| INHERIT | NOINHERIT
| LOGIN | NOLOGIN
| REPLICATION | NOREPLICATION
| BYPASSRLS | NOBYPASSRLS
| CONNECTION LIMIT connlimit
| [ ENCRYPTED ] PASSWORD 'password' | PASSWORD NULL
| VALID UNTIL 'timestamp'
ALTER ROLE name RENAME TO new_name
ALTER ROLE { role_specification | ALL } [ IN DATABASE database_name ]
SET configuration_parameter { TO | = } { value | DEFAULT }
ALTER ROLE { role_specification | ALL } [ IN DATABASE database_name ]
SET configuration_parameter FROM CURRENT
ALTER ROLE { role_specification | ALL } [ IN DATABASE database_name ]
RESET configuration_parameter
ALTER ROLE { role_specification | ALL } [ IN DATABASE database_name ] RESET ALL
where role_specification can be:
role_name
| CURRENT_USER
| SESSION_USER
Description
ALTER ROLE changes the attributes of a role.
The first variant of this command listed above can change many of the role attributes specified in CREATE ROLE (it covers all possible attributes except for adding and removing membership; use GRANT and REVOKE for that). Attributes not mentioned in the command retain their previous settings. Database superusers can change any of these settings for any role. Roles with CREATEROLE privilege can change any of these settings except SUPERUSER, REPLICATION, and BYPASSRLS, but only for non-superuser and non-replication roles. Ordinary roles can only change their own password. The second variant changes the name of the role. Database superusers can rename any role. Roles with CREATEROLE privilege can rename any non-superuser role. The current session user cannot be renamed (if you need to do this, connect as a different user). Since MD5-encrypted passwords use the role name as salt, renaming a role will clear its password if it was MD5-encrypted.
The remaining variants are used to change the session default value of a configuration variable for a role, either for all databases or only for the database specified in IN DATABASE. If ALL is specified instead of a role name, the setting is changed for all roles. Using ALL with IN DATABASE is effectively the same as using ALTER DATABASE ... SET ....
Whenever the role subsequently starts a new session, the specified value becomes the session default and overrides whatever setting is present in postgresql.conf. This only happens at login time; executing SET ROLE or SET SESSION AUTHORIZATION does not cause new configuration values to be set. Values set for all databases are overridden by database-specific settings for a role. Database-specific or role-specific settings override settings made for all roles. Superusers can change anyone's session defaults. Roles with CREATEROLE privilege can change defaults for non-superusers. Ordinary roles can only set defaults for themselves. Some configuration variables cannot be set this way, or can only be set by a command issued by a superuser. Only superusers can change settings for all roles in all databases.
Parameters
name
The name of the role whose attributes are to be modified.
CURRENT_USER
Modify the current user instead of an explicitly identified role.
SESSION_USER
Modify the current session user instead of an explicitly identified role.
SUPERUSER
NOSUPERUSER
CREATEDB
NOCREATEDB
CREATEROLE
NOCREATEROLE
INHERIT
NOINHERIT
LOGIN
NOLOGIN
REPLICATION
NOREPLICATION
BYPASSRLS
NOBYPASSRLS
CONNECTION LIMIT connlimit
[ ENCRYPTED ] PASSWORD 'password'
PASSWORD NULL
VALID UNTIL 'timestamp'
These clauses modify the attributes originally set by CREATE ROLE. See the CREATE ROLE reference page for more information.
new_name
The new name of the role.
database_name
The name of the database in which to set the configuration variable.
configuration_parameter
value
Sets the session default value of the specified configuration parameter for this role to the given value. If value is DEFAULT, or equivalently if RESET is used, the role-specific variable setting is removed, so the role will inherit the system-wide default setting in new sessions. Use RESET ALL to clear all role-specific settings. SET FROM CURRENT saves the current value of the parameter in the session as the role-specific value. If IN DATABASE is specified, the configuration parameter is set or removed only for the given role and database combination.
Role-specific variable settings take effect only at login time; SET ROLE and SET SESSION AUTHORIZATION do not process role-specific variable settings.
Notes
Use CREATE ROLE to add new roles and DROP ROLE to remove a role.
ALTER ROLE cannot change role membership. Use GRANT and REVOKE to do that.
Use caution when specifying an unencrypted password with this command. The password will be transmitted to the server in plaintext and may also be logged in the client's command history or the server log. psql includes a command \password that can be used to change a role's password without exposing the plaintext password. It is also possible to bind a session default to a specific database rather than a role; see ALTER DATABASE.
In case of a conflict, database-role-specific settings override role-specific settings, which in turn override database-specific settings.
Examples
# Change a role's password:
ALTER ROLE davide WITH PASSWORD 'hu8jmn3';
# Remove a role's password:
ALTER ROLE davide WITH PASSWORD NULL;
# Change a password's expiration date, specifying that the password should expire at noon on May 4, 2015 (in a time zone one hour ahead of UTC):
ALTER ROLE chris VALID UNTIL 'May 4 12:00:00 2015 +1';
# Make a password valid forever:
ALTER ROLE fred VALID UNTIL 'infinity';
# Give a role the ability to create other roles and new databases:
ALTER ROLE miriam CREATEROLE CREATEDB;
# Specify a non-default setting of the maintenance_work_mem parameter for a role:
ALTER ROLE worker_bee SET maintenance_work_mem = 100000;
# Specify a database-specific non-default setting of the client_min_messages parameter for a role:
ALTER ROLE fred IN DATABASE devel SET client_min_messages = DEBUG;