Editing PostgreSQL (section)

== Security ==
PostgreSQL manages its internal security on a per-[[Role-oriented programming|role]] basis. A role is generally regarded to be a user (a role that can log in), or a group (a role of which other roles are members). Permissions can be granted or revoked on any object down to the column level, and can allow or prevent the visibility/creation/alteration/deletion of objects at the database, [[#Schemas|schema]], table, and row levels.

PostgreSQL's SECURITY LABEL feature (extension to SQL standards), allows for additional security; with a bundled loadable module that supports label-based [[mandatory access control]] (MAC) based on [[Security-Enhanced Linux]] (SELinux) security policy.<ref>{{Cite web |url=https://wiki.postgresql.org/wiki/SEPostgreSQL_Documentation |title=SEPostgreSQL Documentation – PostgreSQL wiki |website=wiki.postgresql.org}}</ref><ref>{{Cite web |url=https://selinuxproject.org/page/NB_SQL_9.3 |title=NB SQL 9.3 - SELinux Wiki |website=selinuxproject.org}}</ref><!--through the use of "sepgsql extension"; provided in all supported versions; in "contrib"<ref>https://www.postgresql.org/docs/current/static/sepgsql.html {{Bare URL inline|date=March 2022}}</ref>).-->

PostgreSQL natively supports a broad number of external authentication mechanisms, including:

* Password: either [[Salted Challenge Response Authentication Mechanism|SCRAM-SHA-256]],<ref>{{cite web |title = PostgreSQL 10 Documentation: Appendix E. Release Notes |date=August 12, 2021|url=https://www.postgresql.org/docs/10/release-10.html#id-1.11.6.16.3}}</ref> [[MD5]] or plain-text
* [[Generic Security Services Application Program Interface]] (GSSAPI)
* [[Security Support Provider Interface]] (SSPI)
* [[Kerberos (protocol)|Kerberos]]
* [[Ident protocol|ident]] (maps O/S user-name as provided by an ident server to database user-name)
* Peer (maps local user name to database user name)
* [[Lightweight Directory Access Protocol]] (LDAP)
** [[Active Directory]] (AD)
* [[RADIUS]]
* Certificate
* [[Pluggable authentication module]] (PAM)

The GSSAPI, SSPI, Kerberos, peer, ident and certificate methods can also use a specified "map" file that lists which users matched by that authentication system are allowed to connect as a specific database user.

These methods are specified in the cluster's host-based authentication configuration file (<kbd>pg_hba.conf</kbd>), which determines what connections are allowed. This allows control over which user can connect to which database, where they can connect from (IP address, IP address range, domain socket), which authentication system will be enforced, and whether the connection must use [[Transport Layer Security]] (TLS).