CREATE ROLE documentation:
Note that roles are defined at the database cluster level, and so are valid in all databases in the cluster.
pg_dump dumps a single database, you can't extract roles with that utility. The
pg_dumpall --roles-only command you proposed will do the work - however you may need to filter its output so that only desired roles will be created in the new cluster.
Roles are stored in the
pg_authid catalog, which is physically stored in the
data/global/ subfolder of a PostgreSQL installation, together with the other cluster-wide tables. You can query the contents of
pg_authid through the
NOTE: you will need superuser rights to dump the roles. Otherwise, you'd get a permission denied on
pg_authid - and even when a superuser grants
SELECT rights, you'd get the same error. In this case, however, you can list the roles by querying
COPY it to a file and roll some magic to create the necessary
CREATE ROLE and
ALTER ROLE statements.