How To Configure Webserver Authentication in pgAdmin 4

November 30, 2021

pgAdmin 4 supports multiple authentication methods through its pluggable architecture.
In addition to the four existing authentication methods; Kerberos, LDAP, OAuth 2.0, and internal, pgAdmin4 now supports webserver authentication. 

Web server authentication (HTTP authentication) is the most common application of third-party authentication. With web server authentication, the web server performs the authentication and the application trusts the web server.

To enable web server authentication, the web server must be configured for any authentication mechanism (such as HTTP Basic auth or Shibboleth) which sets either headers or environment variables which will be used in pgAdmin to identify the user.

This blog will guide you to set up the apache2 webserver authentication with HTTP BASIC auth in pgAdmin 4, on Debian or Ubuntu Linux. The process is the same on other Linux distributions, but file, directory, and service names may differ.

Configure pgAdmin 4 for Apache2 Password Authentication

To enable web server authentication for pgAdmin, you must configure the settings below in the config_local.py or config_system.py file (see the config.py documentation) on the system where pgAdmin is installed in Server mode. 

AUTHENTICATION_SOURCES

To enable web server authentication support, you need to add ‘webserver’ in the list.

WEBSERVER_REMOTE_USER

Set this variable to any header or environment variable to get the webserver remote user details. Common values: REMOTE_USER, HTTP_X_FORWARDED_USER, X-Forwarded-User.

WEBSERVER_AUTO_CREATE_USER

This parameter determines whether the end user should be stored in the pgAdmin database for the future login or not. If it is set to False, the corresponding user must be created by pgAdmin admin otherwise login will be denied.

After editing above parameters, config_system.py will look as below:

# Webserver Authentication

AUTHENTICATION_SOURCES = ['webserver', 'internal']

WEBSERVER_REMOTE_USER = 'REMOTE_USER'

WEBSERVER_AUTO_CREATE_USER = True

Configuring Apache Password Authentication

Create the Password File

We will create a file for this purpose called htpasswd within our /etc/apache2 configuration directory. You will be asked to supply and confirm a password for the user.

sudo htpasswd -c /etc/apache2/htpasswd pgadmin_user1

Leave out the -c argument for any additional users to add.

sudo htpasswd /etc/apache2/htpasswd pgadmin_user2

You may want to change the permissions to  secure a password file.

chmod 400 /etc/apache2/htpasswd
chown www-data /etc/apache2/htpasswd

Configuring Access Control within the apache2 conf 

To enable web server authentication with apache2, the directives below are required to be set:

AuthType -  ‘Basic’.
AuthName -  Message will be displayed to the user when prompting for credentials. 
AuthUserFile - To point Apache to the password file.
Require - Equal to ‘valid-user’ which means anyone who can verify their identity with a password will be allowed in.

Here is a code snippet for pgadmin4.conf which is running behind apache2 server under the directory /etc/apache2/conf-available/.

WSGIDaemonProcess pgadmin processes=1 threads=25 python-home=/usr/pgadmin4/venv
WSGIScriptAlias /pgadmin4 /usr/pgadmin4/web/pgAdmin4.wsgi

<Directory /usr/pgadmin4/web/>
    WSGIProcessGroup pgadmin
    WSGIApplicationGroup %{GLOBAL}
    AuthType Basic
    AuthName "Restricted Content"
    AuthUserFile /etc/apache2/htpasswd
    Require valid-user
</Directory>

Save and close the file. Restart Apache to implement your password policy:

sudo service apache2 restart

Confirm the Password Authentication

To confirm that your content is protected, try to access your restricted content in a web browser. You should be presented with a username and password prompt that looks like this:

pgadmin-test.org website sign in screenshot

Entering the correct username & password created previously will allow access to pgAdmin.

pgadmin test website screenshot

Conclusion

You should now have everything you need to set up basic authentication for pgAdmin4. For any queries or further assistance, write to us at pgadmin-support@lists.postgresql.org.

Read moreHow to Use Logical Replication in pgAdmin4

Share this

Relevant Blogs

pgAdmin User Management in Server Mode

pgAdmin can be deployed as a web application by configuring the app to run in server mode. One can check out server deployment on how to run pgAdmin in...
August 24, 2023

pgAdmin CI/CD

Almost exactly three years ago I wrote a blog on my personal page entitled Testing pgAdmin which went into great detail discussing how we test pgAdmin prior to releases. Back...
August 24, 2023

More Blogs

EDB Postgres Advanced Server 15 TPS Benchmark

Overview There is often a need to increase the count of user-base connected to an application mainly due to business requirements due to factors such as business growth and addition...
August 22, 2023

Guide to ANY_VALUE() Functionality in PostgreSQL 16

Introduction The demand for effective and robust database management solutions has never been higher as businesses continue to produce and analyze enormous amounts of data. One of the top relational...
August 08, 2023