PostgreSQL Login Fails with PAM Authentication Failure

Your application, migration job, or reporting tool cannot log in to PostgreSQL,
and the credentials are definitely correct.

Symptoms

  • The application log shows:
PAM Authentication Failure
  • Logins are rejected even though the username and password are unchanged and
    correct.
  • The database logs show a PAM or IAM authentication failure rather than an
    ordinary PostgreSQL password error.
  • The failure often starts right after someone adjusted grants on the database.

Cause

The failing user has been granted one of the teleport* PostgreSQL roles — for
example teleport, teleport_admin, or teleport_role.

Those roles exist so that Teleport can authenticate developer sessions using
IAM-based authentication, and the platform creates them automatically on every
managed instance. When a teleport* role is granted to an ordinary user,
PostgreSQL tries to authenticate that user through the Teleport IAM path instead
of the normal password or IAM-token path. The user is not a Teleport-managed
identity, so authentication fails no matter what password is supplied.

This applies on every cloud provider.

Fix

Revoke the role from the affected user:

REVOKE teleport FROM <username>;
REVOKE teleport_admin FROM <username>;
REVOKE teleport_role FROM <username>;

Run only the lines matching the roles actually granted. Authentication returns to
the normal mechanism immediately afterwards — no restart is needed, though your
application may need to re-establish its connection pool.

Prevention

Never grant a teleport* role to a standard PostgreSQL user or service account.
That includes accounts used by:

  • Applications
  • CI/CD pipelines
  • Database migrations
  • Reporting tools
  • Database clients

If a user needs broader privileges, grant a role scoped to the data it needs
rather than borrowing a platform role. The teleport* roles are reserved for
Teleport-mediated access and are not a general-purpose permission set.

Still having issues?

If the error persists after revoking the roles, raise a request with the database
name, the affected username, and the exact error from your application log.

Related articles


Did this page help you?