How to fix FATAL: Ident authentication failed for user in PostgreSQL

PostgreSQLINTERMEDIATEMEDIUMUpdated Dec 26, 2025· 118 views

The "FATAL: Ident authentication failed for user" error occurs when PostgreSQL authentication method is set to ident but the operating system username does not match the PostgreSQL database username. This typically affects local connections and requires changing pg_hba.conf to use password authentication instead.

Quick fix

Fixes FATAL: Ident authentication failed for user

# Query from psql (if you can connect as the postgres OS user):
sudo -u postgres psql -c "SHOW hba_file;"

# Common file locations:
/var/lib/postgresql/VERSION/main/pg_hba.conf     # Debian/Ubuntu
/var/lib/pgsql/VERSION/data/pg_hba.conf          # RHEL/CentOS/Oracle Linux
/usr/local/var/postgres/pg_hba.conf              # macOS Homebrew (Intel)
/opt/homebrew/var/postgres/pg_hba.conf           # macOS Homebrew (Apple Silicon)
  1. Locate the pg_hba.conf configuration file
  2. Change authentication from ident to md5 or scram-sha-256
  3. Reload PostgreSQL configuration to apply changes
  4. Set or verify the database user password
postgresql — error
# Query from psql (if you can connect as the postgres OS user):
sudo -u postgres psql -c "SHOW hba_file;"
# Common file locations:
/var/lib/postgresql/VERSION/main/pg_hba.conf     # Debian/Ubuntu
/var/lib/pgsql/VERSION/data/pg_hba.conf          # RHEL/CentOS/Oracle Linux
/usr/local/var/postgres/pg_hba.conf              # macOS Homebrew (Intel)
/opt/homebrew/var/postgres/pg_hba.conf           # macOS Homebrew (Apple Silicon)
FATAL: Ident authentication failed for user

What this error means

PostgreSQL uses the ident authentication method to verify user identity by asking the operating system to confirm which user initiated the database connection. When ident authentication is enabled, PostgreSQL compares the OS username against the requested database user. If they do not match (and no mapping is configured), the connection is rejected. The error is fatal because PostgreSQL terminates the connection immediately during the authentication phase, before any SQL commands can be executed. This method is designed for trusted local networks where the OS user identity reliably corresponds to the database user, but it is incompatible with application servers, containers, and remote connections that use different OS and database user identities. On modern systems, ident authentication is considered legacy. PostgreSQL now recommends password-based authentication (MD5, SCRAM-SHA-256) for better security and flexibility.

Typical symptoms

  • Connection attempts fail immediately with "FATAL: Ident authentication failed for user {username}"
  • psql command fails with ident error when connecting as a non-postgres OS user
  • Remote applications cannot connect even with valid database passwords
  • Docker containers or VMs cannot establish database connections
  • Running "sudo -u postgres psql" works, but direct psql commands fail
  • Replication and migration tools receive ident authentication errors
  • CI/CD pipelines fail at the database connection stage

Common causes

  1. pg_hba.conf is configured with "ident" authentication method, but the client OS username differs from the database username (most common cause)
  2. The pg_ident.conf file is missing or does not contain a mapping between the OS user and database user
  3. Attempting remote TCP/IP connections with ident authentication (ident only works for local Unix domain sockets)
  4. Database user created without a corresponding OS user with the same name
  5. Container or virtual machine OS user does not match the target PostgreSQL database user
  6. The ident map name specified in pg_hba.conf does not exist in pg_ident.conf
  7. Ident service (identd) is not running or is blocked by firewall (for TCP/IP ident attempts)

How to fix "FATAL: Ident authentication failed for user"

1Locate the pg_hba.conf configuration file

The pg_hba.conf file controls PostgreSQL authentication rules. Find its location:

bash
# Query from psql (if you can connect as the postgres OS user):
sudo -u postgres psql -c "SHOW hba_file;"

# Common file locations:
/var/lib/postgresql/VERSION/main/pg_hba.conf     # Debian/Ubuntu
/var/lib/pgsql/VERSION/data/pg_hba.conf          # RHEL/CentOS/Oracle Linux
/usr/local/var/postgres/pg_hba.conf              # macOS Homebrew (Intel)
/opt/homebrew/var/postgres/pg_hba.conf           # macOS Homebrew (Apple Silicon)

View the file to check the current authentication method:

bash
cat /var/lib/postgresql/14/main/pg_hba.conf
2Change authentication from ident to md5 or scram-sha-256

The recommended fix is to replace ident with password-based authentication. This allows connections using usernames and passwords instead of OS user identity.

bash
# Backup the original file:
sudo cp /var/lib/postgresql/14/main/pg_hba.conf /var/lib/postgresql/14/main/pg_hba.conf.backup

# Edit the file with sudo:
sudo nano /var/lib/postgresql/14/main/pg_hba.conf

Find lines containing "ident":

bash
local   all             all                                     ident
host    all             all             127.0.0.1/32            ident
host    all             all             ::1/128                 ident

Change them to:

bash
local   all             all                                     scram-sha-256
host    all             all             127.0.0.1/32            scram-sha-256
host    all             all             ::1/128                 scram-sha-256

For PostgreSQL 9.x or older systems, use "md5" instead of "scram-sha-256". SCRAM-SHA-256 is more secure and is the modern default.

3Reload PostgreSQL configuration to apply changes

After modifying pg_hba.conf, reload the configuration without stopping the database (preferred) or perform a full restart.

bash
# Reload configuration (does not disconnect existing clients):
sudo systemctl reload postgresql

# Alternative reload methods:
sudo -u postgres pg_ctl reload -D /var/lib/postgresql/14/main
sudo killall -HUP postgres

# If reload does not work, restart the service:
sudo systemctl restart postgresql

# Verify PostgreSQL is running:
sudo systemctl status postgresql
4Set or verify the database user password

Password authentication requires that the database user has a password set. If no password exists, create one.

bash
# Connect as the postgres OS user (if using peer auth for that user):
sudo -u postgres psql

# Inside psql, set or update the password:
alter user postgres with password 'your_secure_password';

# Verify the user exists:
\du

# Exit psql:
\quit

Replace "postgres" and "your_secure_password" with your actual database user and a strong password.

5Test the connection using password authentication

Verify the fix by connecting with the password you just set.

bash
# Connect using password prompt (replace username and host as needed):
psql -U postgres -h 127.0.0.1 -W

# Alternatively, provide password via PGPASSWORD environment variable:
PGPASSWORD="your_password" psql -U postgres -h 127.0.0.1 -d postgres

# If the connection succeeds, run a simple query:
select version();

If you can execute the query without "Ident authentication failed" error, the fix is complete.

6For remote connections: verify TCP/IP is listening and properly configured

If connecting from a remote host, ensure PostgreSQL is configured to accept remote connections.

bash
# Check the listen_addresses setting in postgresql.conf:
sudo grep "^listen_addresses" /etc/postgresql/14/main/postgresql.conf

# Should show:
listen_addresses = 'localhost'  # for local only
listen_addresses = '*'         # for all interfaces (less secure)
listen_addresses = '192.168.1.100'  # for specific IP

# If you need to change it, edit postgresql.conf:
sudo nano /etc/postgresql/14/main/postgresql.conf

# Restart PostgreSQL to apply:
sudo systemctl restart postgresql

# Verify remote connections in pg_hba.conf are set to password auth, not ident:
grep "^host" /var/lib/postgresql/14/main/pg_hba.conf

All TCP/IP connections (from remote hosts) must use password, SCRAM, or certificate authentication. Ident is not supported for remote connections.

Advanced notes

Ident authentication (RFC 1413) is a legacy method intended only for trusted local networks. The ident protocol assumes the client's ident server (identd) honestly reports the OS user, making it unsuitable for untrusted networks, containers, or cloud environments.

PostgreSQL 10+ strongly prefers SCRAM-SHA-256 over MD5 due to cryptographic weaknesses in MD5. If your system supports it, always use SCRAM-SHA-256 for new installations or when upgrading authentication configurations.

For Docker containers, ident authentication will never work because the container OS user identity cannot map to the host. Use password or SCRAM authentication exclusively in containerized deployments.

To debug ident failures, enable PostgreSQL logging:

sql
ALTER SYSTEM SET log_connections = on;
ALTER SYSTEM SET log_disconnections = on;
SELECT pg_reload_conf();

Then check /var/log/postgresql/postgresql.log for detailed authentication attempt information.

On macOS with Homebrew, the default pg_hba.conf often uses "trust" for local connections (no authentication), which is convenient for development but insecure in any shared or networked setup. Change "trust" to "scram-sha-256" or "md5" for production systems.

Frequently asked questions

What does "FATAL: Ident authentication failed for user" mean?
PostgreSQL uses the ident authentication method to verify user identity by asking the operating system to confirm which user initiated the database connection. When ident authentication is enabled, PostgreSQL compares the OS username against the requested database user. If they do not match (and no mapping is configured), the connection is rejected.
How do I fix "FATAL: Ident authentication failed for user"?
The "FATAL: Ident authentication failed for user" error occurs when PostgreSQL authentication method is set to ident but the operating system username does not match the PostgreSQL database username. This typically affects local connections and requires changing pg_hba.conf to use password authentication instead.
What causes "FATAL: Ident authentication failed for user"?
pg_hba.conf is configured with "ident" authentication method, but the client OS username differs from the database username (most common cause) The pg_ident.conf file is missing or does not contain a mapping between the OS user and database user Attempting remote TCP/IP connections with ident authentication (ident only works for local Unix domain sockets)
Is the "FATAL: Ident authentication failed for user" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading