Skip to content

0P000 — invalid_role_specification

PostgreSQL SQLSTATE 0P000: invalid_role_specification, source-backed diagnosis and recovery guidance.

0P000

At a glance

SQLSTATE 0P000 is invalid_role_specification in Class 0P. Under ENABLE_SSPI, the fixed Windows SSPI path uses it for server LOG branches while converting a SAM account name to a UPN; it is not a generic missing-role login result or a client ErrorResponse.

Field Value
SQLSTATE 0P000
Condition invalid_role_specification
Status active
Known present by 7.4
Locked snapshots 9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3
Macros ERRCODE_INVALID_ROLE_SPECIFICATION
Aliases —

Meaning

0P000 is invalid_role_specification. In the fixed pg_SSPI_make_upn path, PostgreSQL builds DOMAIN\user, calls Windows TranslateName to obtain user@realm, and logs 0P000 when translation fails, the result has no @, or the realm/account would not fit the target buffers. These are server LOG branches under ENABLE_SSPI, not a client ErrorResponse and not a generic missing-role result.

Diagnosis

Confirm that the failing path is Windows SSPI and inspect the server log together with the SAM account/domain and configured realm or UPN mapping. TranslateName failures (including a result without @) log could not translate name; an oversized realm logs realm name too long, and an oversized translated account logs translated account name too long. A trust-auth disposable target cannot faithfully exercise this external identity boundary; a startup ErrorResponse may instead be 28000 or 28P01.

Response

Repair the SSPI account/realm mapping or Windows name translation configuration, then establish a new connection. Keep these server-log diagnostics separate from startup authentication responses, SQL role existence, and password failures.

Messages

The fixed SSPI source emits LOG with SQLSTATE 0P000 for these primary templates: could not translate name, realm name too long, and translated account name too long. These are server log records; a client exception or startup ErrorResponse without the matching server log is not proof of 0P000.

Representative case

This page has no selected natural SQL run. The structured evidence records a source or definition boundary; a client-side RAISE would not represent a backend mechanism.

Versions

The generated facts table records the locked catalogue snapshots and earliest observed definition. This page has no selected natural SQL run; the fixed REL_18_6/REL_10_23 SSPI source comparison must not be read as an observed runtime result or as a claim about every intermediate release.

Sources

  • src.auth-name-translation.18.6 — src/backend/libpq/auth.c at REL_18_6 commit 724edf9bde9d356724ad384a2e196edc3c9f80f7; fixed blob SHA-256 94252cb1e2c49b0ddb15f6596d0abf8056c84493de07cc81439da4c5b07018f1 (source).
  • src.auth-name-translation.10.23 — src/backend/libpq/auth.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61 (source).
  • src.auth-sspi-upn.10.23 — src/backend/libpq/auth.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61 (source).
  • src.calls.REL_18_6 / src.calls.REL_10_23 — fixed local call scans, SHA-256 9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf / 00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c; these scans preserve the resolved call context used by the claims.