All these questions are basically answered in the documentation. To be specific:
A role is an entity that can own database objects and have database privileges; a role can be considered a "user", a "group", or both depending on how it is used.
That implies that internally there is no difference between these, except the LOGIN
option. If you specify LOGIN
(or use CREATE USER
):
CREATE ROLE dezso WITH LOGIN PASSWORD 'bla';
dezso
will become a login role, otherwise not. You can specify passwords for non-login roles, too - if you later decide to make it a login role, use
CREATE ROLE non_login_role PASSWORD 'bla';
--later
ALTER ROLE non_login_role WITH LOGIN;
You are right when saying 'it's only possible to authenticate with login role'. Note, however, that a password is not always necessary - if you use anything else than the password
or md5
authentication methods. On the other hand this means that a role without the LOGIN
option set cannot log in in any way.
Finally, you may set rules in pg_hba.conf
for non-login roles, but as it's used only for authentication, those roles will have no effect (unless you enable login later, as above).