PostgreSQL Login Fails with PAM Authentication Failure
Your application, migration job, or reporting tool cannot log in to PostgreSQL,
and the credentials are definitely correct.
Symptoms
- The application log shows:
PAM Authentication Failure- Logins are rejected even though the username and password are unchanged and
correct. - The database logs show a PAM or IAM authentication failure rather than an
ordinary PostgreSQL password error. - The failure often starts right after someone adjusted grants on the database.
Cause
The failing user has been granted one of the teleport* PostgreSQL roles — for
example teleport, teleport_admin, or teleport_role.
Those roles exist so that Teleport can authenticate developer sessions using
IAM-based authentication, and the platform creates them automatically on every
managed instance. When a teleport* role is granted to an ordinary user,
PostgreSQL tries to authenticate that user through the Teleport IAM path instead
of the normal password or IAM-token path. The user is not a Teleport-managed
identity, so authentication fails no matter what password is supplied.
This applies on every cloud provider.
Fix
Revoke the role from the affected user:
REVOKE teleport FROM <username>;
REVOKE teleport_admin FROM <username>;
REVOKE teleport_role FROM <username>;Run only the lines matching the roles actually granted. Authentication returns to
the normal mechanism immediately afterwards — no restart is needed, though your
application may need to re-establish its connection pool.
Prevention
Never grant a teleport* role to a standard PostgreSQL user or service account.
That includes accounts used by:
- Applications
- CI/CD pipelines
- Database migrations
- Reporting tools
- Database clients
If a user needs broader privileges, grant a role scoped to the data it needs
rather than borrowing a platform role. The teleport* roles are reserved for
Teleport-mediated access and are not a general-purpose permission set.
Still having issues?
If the error persists after revoking the roles, raise a request with the database
name, the affected username, and the exact error from your application log.
Related articles
Updated about 6 hours ago