Is it possible to grant an AD group in PG 13 without sorting to creating the group in the database?

Similar to how AD groups can be granted directly in SQL Server.

The PG server is on a Windows server that is already joined to the AD domain.

Note: I asking about authorization and not authentication against AD.


No. All roles have to be created with CREATE ROLE in the database.

The existence of the role in the database is necessary, because it is associated with permissions in the database (authorization). Authorization is not managed through an external authority. What is managed externally is authentication.

You could write or find some software that synchronizes PostgreSQL roles with what is in your Active Directory.

  • I guess, I also need to sync AD users? Then what is the point of LDAP authentication method if I also need to sync AD groups/users to manage authorization? – geeko May 7 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.