MIME-Version: 1.0
References: <382c1ae1-3ee9-8000-10ed-1a3fce390eac@posteo.de>
In-Reply-To: <382c1ae1-3ee9-8000-10ed-1a3fce390eac@posteo.de>
From: Dave Page <dpage@pgadmin.org>
Date: Mon, 29 Mar 2021 08:27:41 +0000
Message-ID: 
 <CA+OCxoweunYZGJ5kx=c8YCRjuAeOXV48YbBZrJ6BL3n8Mriz=Q@mail.gmail.com>
Subject: Re: OAuth error when logging in
To: Florian Sabonchi <sabonchi@posteo.de>
Cc: pgadmin-hackers <pgadmin-hackers@postgresql.org>,
	Khushboo Vashi <khushboo.vashi@enterprisedb.com>
Content-Type: multipart/alternative; boundary="00000000000065253b05bea8a87e"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2BOCxoweunYZGJ5kx%3Dc8YCRjuAeOXV48YbBZrJ6BL3n8Mriz%3DQ%40mail.gmail.com>
Precedence: bulk

--00000000000065253b05bea8a87e
Content-Type: text/plain; charset="UTF-8"

Hi

On Mon, Mar 29, 2021 at 9:21 AM Florian Sabonchi <sabonchi@posteo.de> wrote:

> Hello I would like to integrate OAuth in PG-Admin. Unfortunately I have
> the error that I am redirected back to the home page. Unfortunately I
> could not find this error, what surprises me is that
> current_user.is_authenticated is set to True. For this reason I just
> wanted to ask maybe someone knows what the problem is. You can find my
> source code here:
>
>
> https://github.com/FlorianJSa/pgadmin4/blob/OAuth2/web/pgadmin/authenticate/__init__.py
>
>
> I would be very happy if someone could help me with this problem.
> Because I unfortunately have no idea what this could be for an issue
>

Khushboo (CC'd) is most familiar with this code as she wrote the plugin
auth system - hopefully she can help point you in the right direction.

However; we have discussed OAuth briefly in the past and never quite
figured out what to do about saving Postgres passwords. Have you thought
about that? The issue is that we won't have anything secret to use in an
encryption key as pgAdmin won't see the user's password. We have the same
issue with Kerberos, however the solution we came up with there was to
simply disable password saving which is fine because in most environments
the user will use Kerberos to authenticate to Postgres anyway (which
Khushboo is working on right now).

-- 
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: http://www.enterprisedb.com

--00000000000065253b05bea8a87e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi</div><br><div class=3D"gmail_quote"><div dir=3D"lt=
r" class=3D"gmail_attr">On Mon, Mar 29, 2021 at 9:21 AM Florian Sabonchi &l=
t;<a href=3D"mailto:sabonchi@posteo.de">sabonchi@posteo.de</a>&gt; wrote:<b=
r></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex=
;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,20=
4,204);padding-left:1ex">Hello I would like to integrate OAuth in PG-Admin.=
 Unfortunately I have <br>
the error that I am redirected back to the home page. Unfortunately I <br>
could not find this error, what surprises me is that <br>
current_user.is_authenticated is set to True. For this reason I just <br>
wanted to ask maybe someone knows what the problem is. You can find my <br>
source code here:<br>
<br>
<a href=3D"https://github.com/FlorianJSa/pgadmin4/blob/OAuth2/web/pgadmin/a=
uthenticate/__init__.py" rel=3D"noreferrer" target=3D"_blank">https://githu=
b.com/FlorianJSa/pgadmin4/blob/OAuth2/web/pgadmin/authenticate/__init__.py<=
/a><br>
<br>
<br>
I would be very happy if someone could help me with this problem. <br>
Because I unfortunately have no idea what this could be for an issue<br></b=
lockquote><div><br></div><div>Khushboo (CC&#39;d) is most familiar with thi=
s code as she wrote the plugin auth system - hopefully she can help point y=
ou in the right direction.</div><div><br></div><div>However; we have discus=
sed OAuth briefly in the past and never quite figured out what to do about =
saving Postgres passwords. Have you thought about that? The issue is that w=
e won&#39;t have anything secret to use in an encryption key as pgAdmin won=
&#39;t see the user&#39;s password. We have the same issue with Kerberos, h=
owever the solution we came up with there was to simply disable password sa=
ving which is fine because in most environments the user will use Kerberos =
to authenticate to Postgres anyway (which Khushboo is working on right now)=
.</div><div>=C2=A0</div></div>-- <br><div dir=3D"ltr" class=3D"gmail_signat=
ure"><div dir=3D"ltr">Dave Page<br>Blog: <a href=3D"http://pgsnake.blogspot=
.com" target=3D"_blank">http://pgsnake.blogspot.com</a><br>Twitter: @pgsnak=
e<br><br>EDB: <a href=3D"http://www.enterprisedb.com" target=3D"_blank">htt=
p://www.enterprisedb.com</a><br><br></div></div></div>

--00000000000065253b05bea8a87e--