# 0P000 — invalid_role_specification

> PostgreSQL SQLSTATE 0P000: invalid_role_specification, source-backed diagnosis and recovery guidance.
---

# 0P000

## At a glance {#at-a-glance}

SQLSTATE `0P000` is **invalid_role_specification** in Class `0P`. Under `ENABLE_SSPI`, the fixed Windows SSPI path uses it for server `LOG` branches while converting a SAM account name to a UPN; it is not a generic missing-role login result or a client ErrorResponse.

<!-- BEGIN SQLSTATE FACTS: generated by scripts/generate.py; do not edit -->

| Field | Value |
| --- | --- |
| SQLSTATE | `0P000` |
| Condition | `invalid_role_specification` |
| Status | `active` |
| Known present by | `7.4` |
| Locked snapshots | `9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3` |
| Macros | `ERRCODE_INVALID_ROLE_SPECIFICATION` |
| Aliases | `—` |

<!-- source facts: data/errcodes/0P000.json -->
<!-- END SQLSTATE FACTS -->

## Meaning {#meaning}

`0P000` is `invalid_role_specification`. In the fixed `pg_SSPI_make_upn` path, PostgreSQL builds `DOMAIN\user`, calls Windows `TranslateName` to obtain `user@realm`, and logs `0P000` when translation fails, the result has no `@`, or the realm/account would not fit the target buffers. These are server `LOG` branches under `ENABLE_SSPI`, not a client ErrorResponse and not a generic missing-role result.

## Diagnosis {#diagnosis}

Confirm that the failing path is Windows SSPI and inspect the server log together with the SAM account/domain and configured realm or UPN mapping. `TranslateName` failures (including a result without `@`) log `could not translate name`; an oversized realm logs `realm name too long`, and an oversized translated account logs `translated account name too long`. A trust-auth disposable target cannot faithfully exercise this external identity boundary; a startup ErrorResponse may instead be 28000 or 28P01.

## Response {#response}

Repair the SSPI account/realm mapping or Windows name translation configuration, then establish a new connection. Keep these server-log diagnostics separate from startup authentication responses, SQL role existence, and password failures.

## Messages {#messages}

The fixed SSPI source emits `LOG` with SQLSTATE `0P000` for these primary templates: `could not translate name`, `realm name too long`, and `translated account name too long`. These are server log records; a client exception or startup ErrorResponse without the matching server log is not proof of `0P000`.

## Representative case {#case}

This page has no selected natural SQL run. The structured evidence records a source or definition boundary; a client-side `RAISE` would not represent a backend mechanism.

## Versions {#versions}

The generated facts table records the locked catalogue snapshots and earliest observed definition. This page has no selected natural SQL run; the fixed REL_18_6/REL_10_23 SSPI source comparison must not be read as an observed runtime result or as a claim about every intermediate release.

## Related {#related}

- [`28000` — invalid_authorization_specification](../28000/)
- [`28P01` — related condition](../28p01/)

## Sources {#sources}

- `src.auth-name-translation.18.6` — `src/backend/libpq/auth.c` at `REL_18_6` commit `724edf9bde9d356724ad384a2e196edc3c9f80f7`; fixed blob SHA-256 `94252cb1e2c49b0ddb15f6596d0abf8056c84493de07cc81439da4c5b07018f1` ([source](https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/libpq/auth.c#L1514-L1516)).
- `src.auth-name-translation.10.23` — `src/backend/libpq/auth.c` at `REL_10_23` commit `02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4`; fixed blob SHA-256 `15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61` ([source](https://github.com/postgres/postgres/blob/02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4/src/backend/libpq/auth.c#L1699-L1701)).
- `src.auth-sspi-upn.10.23` — `src/backend/libpq/auth.c` at `REL_10_23` commit `02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4`; fixed blob SHA-256 `15418faa6d6ee1b2a4ad1e50ebc9b34c2daf4799f7062df425e33dbf777ade61` ([source](https://github.com/postgres/postgres/blob/02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4/src/backend/libpq/auth.c#L1666-L1758)).
- `src.calls.REL_18_6` / `src.calls.REL_10_23` — fixed local call scans, SHA-256 `9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf` / `00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c`; these scans preserve the resolved call context used by the claims.