authentik/website/integrations/services/pgadmin/index.md

title, sidebar_label

title	sidebar_label
Integrate with pgAdmin	pgAdmin

pgAdmin

Support level: Community

What is pgAdmin

pgAdmin is a management tool for PostgreSQL and derivative relational databases such as EnterpriseDB's EDB Advanced Server. It may be run either as a web or desktop application.

-- https://www.pgadmin.org/

:::note This is based on authentik 2024.12.2 and pgAdmin4 8.14 :::

Preparation

The following placeholders are used in this guide:

• pgadmin.company is the FQDN of pgAdmin.
• authentik.company is the FQDN of authentik.

authentik configuration

1. From the Admin interface, navigate to Applications -> Applications.
2. Use the wizard to create a new application and provider. During this process:
   • Note the Client ID, Client Secret, and slug values because they will be required later.
   • Set a Strict redirect URI to https://pgadmin.company/oauth2/authorize.
   • Select any available signing key.

pgAdmin OAuth Configuration

To configure OAuth in pgAdmin, you can either use the config_local.py file or set environment variables if you are deploying pgAdmin in a containerized setup.

Using config_local.py

1. Locate or create the config_local.py file in the /pgadmin4/ directory.

   • If the file does not exist, create it manually.

2. Add the following configuration settings to config_local.py:

   AUTHENTICATION_SOURCES = ['oauth2', 'internal']
   OAUTH2_AUTO_CREATE_USER = True
   OAUTH2_CONFIG = [{
       'OAUTH2_NAME': 'authentik',
       'OAUTH2_DISPLAY_NAME': 'authentik',
       'OAUTH2_CLIENT_ID': '<Client ID from authentik>',
       'OAUTH2_CLIENT_SECRET': '<Client secret from authentik>',
       'OAUTH2_TOKEN_URL': 'https://authentik.company/application/o/token/',
       'OAUTH2_AUTHORIZATION_URL': 'https://authentik.company/application/o/authorize/',
       'OAUTH2_API_BASE_URL': 'https://authentik.company/',
       'OAUTH2_USERINFO_ENDPOINT': 'https://authentik.company/application/o/userinfo/',
       'OAUTH2_SERVER_METADATA_URL': 'https://authentik.company/application/o/<App Slug>/.well-known/openid-configuration',
       'OAUTH2_SCOPE': 'openid email profile',
       'OAUTH2_ICON': '<Fontawesome icon key (e.g., fa-key)>',
       'OAUTH2_BUTTON_COLOR': '<Hexadecimal color code for the login button>'
   }]
   

3. Save the file and restart pgAdmin for the changes to take effect.

   :::note You must restart pgAdmin every time you make changes to config_local.py. :::

Using Environment Variables for Containerized Deployments

For deployments using Docker or Kubernetes, you can configure OAuth using the following environment variables:

1. Set these environment variables in your container:

PGADMIN_CONFIG_AUTHENTICATION_SOURCES="['oauth2', 'internal']"
PGADMIN_CONFIG_OAUTH2_AUTO_CREATE_USER=True
PGADMIN_CONFIG_OAUTH2_CONFIG="[{'OAUTH2_NAME':'authentik','OAUTH2_DISPLAY_NAME':'Login with authentik','OAUTH2_CLIENT_ID':'<Client ID from authentik>','OAUTH2_CLIENT_SECRET':'<Client secret from authentik>','OAUTH2_TOKEN_URL':'https://authentik.company/application/o/token/','OAUTH2_AUTHORIZATION_URL':'https://authentik.company/application/o/authorize/','OAUTH2_API_BASE_URL':'https://authentik.company/','OAUTH2_USERINFO_ENDPOINT':'https://authentik.company/application/o/userinfo/','OAUTH2_SERVER_METADATA_URL':'https://authentik.company/application/o/<App Slug>/.well-known/openid-configuration','OAUTH2_SCOPE':'openid email profile','OAUTH2_ICON':'<Fontawesome icon key (e.g., fa-key)>','OAUTH2_BUTTON_COLOR':'<Hexadecimal color code for the login button>'}]"

General Notes

• To only allow OAuth2 login, set:

  AUTHENTICATION_SOURCES = ['oauth2']
  

  Ensure that you promote at least one user to an admin before disabling the internal authentication.

• To disable automatic user creation, set:

  OAUTH2_AUTO_CREATE_USER = False
  

  Setting this value to False disables automatic user creation. This ensures that only the first signed-in user is registered.

Configuration verification

To confirm that authentik is properly configured with pgAdmin, log out and log back in via authentik. A new button should have appeared on the login page.