MIME-Version: 1.0
References: <1224057069.3389211.1743246544267.ref@mail.yahoo.com>
 <1224057069.3389211.1743246544267@mail.yahoo.com>
In-Reply-To: <1224057069.3389211.1743246544267@mail.yahoo.com>
From: Yogesh Mahajan <yogesh.mahajan@enterprisedb.com>
Date: Tue, 1 Apr 2025 10:00:02 +0530
Message-ID: 
 <CAMa=N=N3-Xf0yQs_KES5Gcx6cwX-XWOS+-06s6XACf-F7SiT-w@mail.gmail.com>
Subject: Re: Pgadmin4 Webserver Authentication + Azure SAML SSO , anyone ever
 managed to configure it?
To: Viktor Madarasz <viktor.madarasz@yahoo.com>
Cc: "pgadmin-support@lists.postgresql.org"
 <pgadmin-support@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000a4d9490631afff45"
Archived-At: 
 <https://www.postgresql.org/message-id/CAMa%3DN%3DN3-Xf0yQs_KES5Gcx6cwX-XWOS%2B-06s6XACf-F7SiT-w%40mail.gmail.com>
Precedence: bulk

--000000000000a4d9490631afff45
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

pgadmin4 only uses Azure AD for authentication. However users logged in
with Azure SSO(or any OAuth2) are the normal users who have all the access
other than adding new users.
Not sure what exactly you mean 'Read only profiles'? What are the
limitations you have seen in pgadmin?

Thanks,
Yogesh Mahajan
EnterpriseDB


On Mon, Mar 31, 2025 at 6:26=E2=80=AFPM Viktor Madarasz <viktor.madarasz@ya=
hoo.com>
wrote:

> Hi
>
> Pgadmin4 Webserver Authentication + Azure SAML SSO , anyone ever managed
> to configure it?
>
> Trying to switch IdP Provider from Onelogin ( working right now with
> Pgadmin4 + Webserver Authentication + Onelogin as IdP provider  to Azure
> SAML SSO.
>
> It looks like the mapped attributes might be the one causing the issue
> coming from Azure side.
>
> The username in a form of firstname.lastname@domain.com gets parsed
> correctly but the actual group memberships not being passed along and
> therefore users being logged in with read only profiles and it does not
> respect their group memberships.
>
> Regards
>
> Viktor
>
>
>

--000000000000a4d9490631afff45
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div style=3D"font-family:verdana,sans-serif;font-siz=
e:small" class=3D"gmail_default">Hi,</div><div style=3D"font-family:verdana=
,sans-serif;font-size:small" class=3D"gmail_default"><br></div><div style=
=3D"font-family:verdana,sans-serif;font-size:small" class=3D"gmail_default"=
>pgadmin4 only uses Azure AD for authentication. However=C2=A0users logged =
in with Azure SSO(or any OAuth2) are the normal users who have all the acce=
ss other than adding new users.</div><div style=3D"font-family:verdana,sans=
-serif;font-size:small" class=3D"gmail_default">Not sure what exactly you m=
ean &#39;Read only profiles&#39;? What are the limitations you have seen in=
 pgadmin?=C2=A0</div><br clear=3D"all"></div><div><div dir=3D"ltr" class=3D=
"gmail_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><font=
 face=3D"verdana, sans-serif">Thanks,</font><div><font face=3D"verdana, san=
s-serif">Yogesh Mahajan</font></div><div><font face=3D"verdana, sans-serif"=
>EnterpriseDB<br></font></div></div></div></div><br></div><br><div class=3D=
"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">O=
n Mon, Mar 31, 2025 at 6:26=E2=80=AFPM Viktor Madarasz &lt;<a href=3D"mailt=
o:viktor.madarasz@yahoo.com">viktor.madarasz@yahoo.com</a>&gt; wrote:<br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,20=
4);padding-left:1ex"><div><div style=3D"font-family:&quot;Helvetica Neue&qu=
ot;,Helvetica,Arial,sans-serif;font-size:10px"><div dir=3D"ltr"><font size=
=3D"3">Hi<br><br><span>Pgadmin4 Webserver Authentication + Azure SAML SSO ,=
 anyone ever managed to configure it?<br><br>Trying to switch IdP Provider =
from Onelogin ( working right now with Pgadmin4 + Webserver Authentication =
+ Onelogin as IdP provider=C2=A0 to Azure SAML SSO.<br><br>It looks like th=
e mapped attributes might be the one causing the issue coming from Azure si=
de.<br><br>The username in a form of <a href=3D"mailto:firstname.lastname@d=
omain.com" target=3D"_blank">firstname.lastname@domain.com</a> gets parsed =
correctly but the actual group memberships not being passed along and there=
fore users being logged in with read only profiles and it does not respect =
their group memberships.</span></font></div><div dir=3D"ltr"><font size=3D"=
3"><span><br></span></font></div><div dir=3D"ltr"><font size=3D"3"><span>Re=
gards<br><br>Viktor<br></span><br></font><br></div></div></div></blockquote=
></div>

--000000000000a4d9490631afff45--