Message-ID: <9886a78311a66418e5ebd5c2a42bf14987d7147a.camel@cybertec.at>
Subject: Re: Can we lock or expire a ROLE / USER
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: "Subramanian,Ramachandran" <ramachandran.subramanian@alte-leipziger.de>,
  "pgsql-novice@lists.postgresql.org"	 <pgsql-novice@lists.postgresql.org>
Date: Fri, 19 Sep 2025 17:55:16 +0200
In-Reply-To: <04421b66a0c74a97b8378b5dd99caced@alte-leipziger.de>
References: <04421b66a0c74a97b8378b5dd99caced@alte-leipziger.de>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-2.fc42) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/9886a78311a66418e5ebd5c2a42bf14987d7147a.camel%40cybertec.at>
Precedence: bulk

On Fri, 2025-09-19 at 08:32 +0000, Subramanian,Ramachandran wrote:
> =C2=A0=C2=A0 Absolute novice in Postgresql, coming from the Mainframe wor=
ld.=C2=A0 Kindly forgive my ignorance.
> =C2=A0
> Is it possible to LOCK or DEACTIVATE or EXPIRE a USER ( ROLE with LOGIN )=
 after
> =C2=A0
> =C2=A0=C2=A0=C2=A01. A set period of inactivity
> =C2=A0=C2=A0=C2=A02. 5 Wrong password attempts
> =C2=A0
> I searched through the manals and did not find any mention of such a faci=
lity.

PostgreSQL doesn't offer support for these functionalities.
It also does not allow you to enforce password complexity rules.

> If it is not possible at the database level, can this be implemented in a=
ny other way?

The way to do that is to authenticat database users using a central identit=
y
management system like Kerberos.  See the documentation for a list of suppo=
rted
authentication methods:
https://www.postgresql.org/docs/current/client-authentication.html

Yours,
Laurenz Albe