A PostgreSQL Fatal error like role or username does not exist. This is a very common error which is facing by PostgreSQL Users.

Actually, this is happening because of misconfiguration of System username and Database Username.

Most of the Linux users are trying to log in PostgreSQL using root user. But actually, this is wrong.

You will need to become the operating system user under which PostgreSQL was installed to create the first user account.

Generally, the default user name is Postgres and default database is also Postgres.
Once you install PostgreSQL on Linux, you should set the password for the Postgres user which is the default super user of PostgreSQL.

Please do not try to log in with any other default Linux or Unix system user name.

Set password for the default Postgres user:

sudo passwd postgres

Create another role using “postgres”:
Creating new role “dbrnd”. -p = set the password and -d = allow to create database.

sudo -u postgres createuser dbrnd -d -P

PostgreSQL: How to Install PostgreSQL 9.4 on Ubuntu 14.04?

PostgreSQL: How to Install PostgreSQL 9.6 on Ubuntu 16.04?

If you do not know about the role of pg_hba.conf file, visit the below link.

PostgreSQL: How to Allow Remote Connection to Connect Database

PostgreSQL also has a one more file related user access permission and that is pg_ident.conf.
PostgreSQL provides Ident-based authentication and It works by obtaining the client’s operating system user name and using it as the allowed database user name with an optional user name mapping.

When we are using an external authentication system, system username might not be the same as database username.

To allow external authentication, We should map the system username with database username and we can also set a map name to hide the system username and database username related detail.

For example,

Go to the PostgreSQL data directory and Open pg_ident.conf file.
You can find below lines:

# Put your actual configuration here
# ----------------------------------
# MAPNAME       SYSTEM-USERNAME         PG-USERNAME

You can add value to map system username and database username:

# Put your actual configuration here
# ----------------------------------
# MAPNAME       SYSTEM-USERNAME         PG-USERNAME
User123         LinuxUser               PGUser

Once you map your system user and database user in pg_ident.conf file, you can use map name in pg_hba.conf file to allow external authentication.

Go to your PostgreSQL data directory and open a pg_hba.conf file.

You can add the map name of system user and database user in METHOD column.
For Example,

# TYPE  DATABASE        USER            ADDRESS                 METHOD
host    all             all             120.172.0.0/16          ident map=User123

In this post, I am sharing one permission script to assign EXECUTE permission to the SQL Server Database User.

Generally, we are creating separate read only database user with limited access.

We are assigning only SELECT permission on some the tables and views for a particular read only database user.
But sometimes, this user also require to EXECUTE all stored procedures or a particular stored procedure.

Create a new database role and assign EXECUTE permission:

CREATE ROLE SP_Executor
GO
GRANT EXECUTE TO SP_Executor
GO

Create database user and assign this role to it:

CREATE USER dbrnd FOR LOGIN Database_Readonly_User
GO
EXEC sp_addrolemember N'SP_Executor', N'dbrnd'
GO

Assign EXECUTE permission for a particular stored procedure:

GRANT EXECUTE ON [usp_MyStoredProcedure] TO dbrnd

As a Database Administrator, we are following common practice by creating Database User or Role and assign only require permission to it.

When we are assigning different object level permission to particular Database Role, It is also important check total assigned object to particular Database Role or Which object assigned to which Role/User?

Most of the Database Administrators do not have practice to audit the list of assigned permissions of particular Database User/Role.

It is fine that we are securing database access using specific role, but that is also similarly important to check information about the assigned object and Database Role.
Periodically, Database Administrator should review the list of permissions which assigned to a Database Role/User.

PostgreSQL provides list of system functions for auditing User, Role, and its permissions.

In PostgreSQL, these functions called as Access Privilege Inquiry Functions.
You can find list of functions in this official document.

I have also prepared a small demonstration of this.

First, Create a sample restricted database ROLE:

CREATE ROLE Test_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign SELECT, INSERT permission on one sample tbl_employees table:

GRANT SELECT,INSERT ON tbl_employees TO Test_User;

Using has_table_privilege(), Script to find list of Users or Roles, who have a INSERT permission on tbl_employees.

SELECT rolname 
FROM pg_roles 
WHERE has_table_privilege(rolname, 'tbl_employees', 'INSERT');

Using pg_has_role(), Script to find list of objects, on which particular User or Role have INSERT permission.

SELECT 
	DISTINCT relname
FROM pg_roles CROSS JOIN pg_class
WHERE pg_has_role('test_user', rolname, 'MEMBER')
	AND has_table_privilege(rolname, pg_class.oid, 'INSERT');

In this post, I am sharing the help on how to create, a read-only user with limited access in PostgreSQL Database Server?.

As a Database Administrator, you should create different database users for the different purposes.
In the standard application, there are a few various types of Database Users like Application user, Read-only user, Admin user.

You should always create a shared database role group and assign roles to the user.

Here, I am sharing one script to create the read only user with limited access to PostgreSQL Database. This user can only SELECT table data and also restricted by schema access.

Create the Read-Only user:

CREATE ROLE Read_Only_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign permissions to the read only user:

GRANT CONNECT ON DATABASE YourDatabaseName TO Read_Only_User;
GRANT USAGE ON SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO Read_Only_User;

In the above script, you can find that I restricted user by Database, Schema and gave only SELECT permission for tables.

If you need to give any additional permission like EXECUTE permission for functions, use below script.

GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO Read_Only_User;