PostgreSQL Error 28000

SQLSTATE

28000

Condition name

invalid_authorization_specification

Product

PostgreSQL

Versions

PostgreSQL 13 to 18

Category

Connections, Authentication & Privileges

Last reviewed

24 October 2026

What it means

SQLSTATE 28000 means the server refused the login before or instead of a password check: no pg_hba.conf line allows this connection, the role does not exist or cannot log in, or peer or ident authentication did not match.

Every connection is checked against pg_hba.conf from the top, using the connection type (local socket, host, hostssl, hostnossl), the database, the role and the client address. With no pg_hba.conf entry for host ..., no line matched at all, so the server refused the connection without asking for a password. The documentation describes this as having contacted the server but the server not wanting to talk to you. The address in the message is the client address as the server sees it, which behind NAT, a proxy or a container network may not be the one you expect. Current servers add the encryption state at the end (no encryption, SSL encryption or GSS encryption), which matters when the only matching lines are hostssl or hostnossl.

The same SQLSTATE, 28000 (invalid_authorization_specification), covers the other refusals that are not a wrong password: the role named in the connection does not exist, the role exists but lacks the LOGIN attribute, or a peer or ident rule found that the operating system user does not match the database role. A wrong password is 28P01 instead. psql and other libpq programs print the server message after their own connection to server ... failed: prefix, and the server log often has more detail than the client.

Common causes

• pg_hba.conf has no line for the client's address range, for example after moving the application to a new subnet, container network or cloud region.
• The only matching line is hostssl but the client connects without SSL (the message ends with "no encryption"), or the line names a different database or role.
• pg_hba.conf was edited but the server configuration was not reloaded, or a syntax error in the new line means it is not loaded.
• The role in the connection does not exist: by default libpq uses the operating system user name, so running psql as another OS user tries a role of that name. (Where the matching line uses a password method, a missing role is reported as 28P01 instead.)
• A local peer rule is used and the operating system user does not match the database role (for example running psql -U postgres as your own OS account).
• The role was created with NOLOGIN (CREATE ROLE without LOGIN), which is normal for group roles.

Diagnose it

Read-only These queries only read the system catalogs (pg_catalog, information_schema) and statistics views such as pg_stat_activity and pg_locks. They do not change data, roles or settings, so they are safe to run first.

SELECT rule_number, line_number, type, database, user_name,
       address, netmask, auth_method, error
FROM pg_hba_file_rules
ORDER BY rule_number;

SELECT current_setting('hba_file') AS hba_file,
       current_setting('ssl') AS ssl;

SELECT rolname, rolcanlogin
FROM pg_roles
WHERE rolname IN ('andym', 'joe');

SELECT inet_client_addr() AS client_address,
       current_user,
       current_database();

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

# pg_hba.conf
# TYPE   DATABASE  USER   ADDRESS             METHOD
hostssl  testdb    andym  123.123.123.123/32  scram-sha-256

-- then, as a superuser:
SELECT pg_reload_conf();

CREATE ROLE joe LOGIN PASSWORD 'a-long-random-password';

ALTER ROLE report_reader LOGIN;

Examples

A client address with no matching pg_hba.conf line

Shown as documented in the PostgreSQL documentation (Client Authentication, Authentication Problems). A PostgreSQL 18 server also appends the encryption state, for example ", no encryption" (see the variants above). This example needs a running PostgreSQL server (a login over TCP checked against pg_hba.conf rules), which PGlite does not provide, so it was not reproduced here.

-- From the client machine 123.123.123.123:
-- psql "host=db.example.com dbname=testdb user=andym"

FATAL:  no pg_hba.conf entry for host "123.123.123.123", user "andym", database "testdb"

The role does not exist (default role name from the OS user)

Shown as documented in the PostgreSQL documentation (Tutorial, Creating a Database). The client used the operating system user name as the role name because none was given. This example needs a running PostgreSQL server (a login over a Unix-domain socket), which PGlite does not provide, so it was not reproduced here.

-- As operating system user joe, with no database role named joe:
-- createdb mydb

createdb: error: connection to server on socket "/tmp/.s.PGSQL.5432" failed: FATAL:  role "joe" does not exist

Peer authentication with a different operating system user

The documentation describes peer authentication (the OS user name must match the database role) but does not print this message, so the text is quoted from the PostgreSQL 18.6 source code; psql prints it after its "connection to server on socket ... failed:" prefix. This example needs a running PostgreSQL server (a local socket login with a peer rule), which PGlite does not provide, so it was not reproduced here.

-- pg_hba.conf has:  local  all  all  peer
-- As operating system user sara:
-- psql -U postgres

FATAL:  Peer authentication failed for user "postgres"

How to prevent it

Manage pg_hba.conf as code: one narrow line per application (database, role, address range, scram-sha-256, hostssl where possible), reviewed and deployed with a check of pg_hba_file_rules for errors before the reload. When moving clients to new networks, add their ranges before the move.

Always pass the role and database explicitly in connection strings instead of relying on the operating system user name, and keep group roles NOLOGIN with members that log in.

Common questions

Learn more on CodeWithSQL

• Install PostgreSQL
• Connect to PostgreSQL with DBeaver

Official documentation

• Authentication problems
• The pg_hba.conf file
• Peer authentication
• Tutorial: creating a database

Last technically reviewed 24 October 2026; examples and diagnostics run on PostgreSQL 18.6 documentation; SQL-level parts in PGlite 0.5.11. SQL-level examples were run in PGlite (PostgreSQL compiled to WebAssembly); examples that need a running server are shown as documented in the PostgreSQL documentation.