There's more…

You can check the attributes of a given user in psql as follows:

pguser=# \du alice

This gives the following output:

           List of roles
 Role name | Attributes | Member of
-----------+------------+-----------
 alice     | Create DB  | {}

The CREATE USER and CREATE GROUP commands are actually variations of CREATE ROLE. The CREATE USER username; statement is equivalent to CREATE ROLE username LOGIN;, and the CREATE GROUP groupname; statement is equivalent to CREATE ROLE groupname NOLOGIN;.