From: Ron <ronljohnsonjr@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Using pgadmin as an OAuth2 proxy for PostgreSQL
Date: Mon, 19 Dec 2022 08:49:51 -0600
Message-ID: <63e54f32-14cb-6f77-02b2-d42f094b45c9@gmail.com> (raw)
In-Reply-To: <13f5e9d02dcf428b8e6fe25274ab6a1c@nordlb.de>
References: <13f5e9d02dcf428b8e6fe25274ab6a1c@nordlb.de>
Why not authenticate Postgresql users directly to AD using GSSAPI?
On 12/19/22 07:12, Rettstadt, Tobias wrote:
>
> Hi all,
>
> our current project has the requirement that users should get read access
> to our backend databases. The users are stored in Azure AD and my first
> idea was to use OAuth2 / OIDC to authenticate the users. Since pgadmin
> provides OAuth2 authentication, is it possible to somehow map roles in the
> access token that we get from Azure AD to a Postgres user in pgadmin, so
> that the users can just log into using their Azure AD account and then get
> access to a number of databases that I have configured?
>
> I already tried the OAuth2 login in pgadmin and it’s working fine, but I
> haven’t figured out how to deploy the database credentials. I know that I
> could use a password file, but it has to be located in the storage
> directory of the user, where he could download it using the storage
> manager. Since users should not be able to access the password, we cannot
> use this. It would also be feasible if the owner of the password would
> have to enter the password on the machine of each of the users, but even
> if I select “Save password”, the password is not saved, even though master
> passwords and password saving are activated in the config.
>
> We are running the latest Docker image dpage/pgadmin4 in a Kubernetes
> cluster. The pgadmin version is 6.17.
>
> Thanks in advance for your help and best regards,
>
> Tobias
>
> **************************************************************** Die in
> dieser E-Mail enthaltenen Informationen sind vertraulich. Diese E-Mail ist
> ausschliesslich fuer den Adressaten bestimmt und jeglicher Zugriff durch
> andere Personen ist nicht zulaessig. Falls Sie nicht einer der genannten
> Empfaenger sind, ist jede Veroeffentlichung, Vervielfaeltigung, Verteilung
> oder sonstige in diesem Zusammenhang stehende Handlung untersagt und unter
> Umstaenden ungesetzlich. Sollte diese Nachricht nicht fuer Sie bestimmt
> sein, so bitten wir Sie, den Absender unverzueglich zu informieren und die
> E-Mail zu loeschen.
> **************************************************************** The
> information contained in this e-mail is confidential. This e-mail is
> intended solely for the addressee(s) and may not be accessed by anyone
> else. If you are not a named recipient, any disclosure, copying,
> distribution or related action is prohibited and might be unlawful. If the
> e-mail is not intended for you, please notify the sender immediately and
> delete it. ****************************************************************
--
Angular momentum makes the world go 'round.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ronljohnsonjr@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Using pgadmin as an OAuth2 proxy for PostgreSQL
In-Reply-To: <63e54f32-14cb-6f77-02b2-d42f094b45c9@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox