How To Configure Webserver Authentication in pgAdmin 4

November 30, 2021

pgAdmin 4 supports multiple authentication methods through its pluggable architecture.
In addition to the four existing authentication methods; Kerberos, LDAP, OAuth 2.0, and internal, pgAdmin4 now supports webserver authentication. 

Web server authentication (HTTP authentication) is the most common application of third-party authentication. With web server authentication, the web server performs the authentication and the application trusts the web server.

To enable web server authentication, the web server must be configured for any authentication mechanism (such as HTTP Basic auth or Shibboleth) which sets either headers or environment variables which will be used in pgAdmin to identify the user.

This blog will guide you to set up the apache2 webserver authentication with HTTP BASIC auth in pgAdmin 4, on Debian or Ubuntu Linux. The process is the same on other Linux distributions, but file, directory, and service names may differ.

Configure pgAdmin 4 for Apache2 Password Authentication

To enable web server authentication for pgAdmin, you must configure the settings below in the or file (see the documentation) on the system where pgAdmin is installed in Server mode. 


To enable web server authentication support, you need to add ‘webserver’ in the list.


Set this variable to any header or environment variable to get the webserver remote user details. Common values: REMOTE_USER, HTTP_X_FORWARDED_USER, X-Forwarded-User.


This parameter determines whether the end user should be stored in the pgAdmin database for the future login or not. If it is set to False, the corresponding user must be created by pgAdmin admin otherwise login will be denied.

After editing above parameters, will look as below:

# Webserver Authentication

AUTHENTICATION_SOURCES = ['webserver', 'internal']



Configuring Apache Password Authentication

Create the Password File

We will create a file for this purpose called htpasswd within our /etc/apache2 configuration directory. You will be asked to supply and confirm a password for the user.

sudo htpasswd -c /etc/apache2/htpasswd pgadmin_user1

Leave out the -c argument for any additional users to add.

sudo htpasswd /etc/apache2/htpasswd pgadmin_user2

You may want to change the permissions to  secure a password file.

chmod 400 /etc/apache2/htpasswd
chown www-data /etc/apache2/htpasswd

Configuring Access Control within the apache2 conf 

To enable web server authentication with apache2, the directives below are required to be set:

AuthType -  ‘Basic’.
AuthName -  Message will be displayed to the user when prompting for credentials. 
AuthUserFile - To point Apache to the password file.
Require - Equal to ‘valid-user’ which means anyone who can verify their identity with a password will be allowed in.

Here is a code snippet for pgadmin4.conf which is running behind apache2 server under the directory /etc/apache2/conf-available/.

WSGIDaemonProcess pgadmin processes=1 threads=25 python-home=/usr/pgadmin4/venv
WSGIScriptAlias /pgadmin4 /usr/pgadmin4/web/pgAdmin4.wsgi

<Directory /usr/pgadmin4/web/>
    WSGIProcessGroup pgadmin
    WSGIApplicationGroup %{GLOBAL}
    AuthType Basic
    AuthName "Restricted Content"
    AuthUserFile /etc/apache2/htpasswd
    Require valid-user

Save and close the file. Restart Apache to implement your password policy:

sudo service apache2 restart

Confirm the Password Authentication

To confirm that your content is protected, try to access your restricted content in a web browser. You should be presented with a username and password prompt that looks like this: website sign in screenshot

Entering the correct username & password created previously will allow access to pgAdmin.

pgadmin test website screenshot


You should now have everything you need to set up basic authentication for pgAdmin4. For any queries or further assistance, write to us at

Read moreHow to Use Logical Replication in pgAdmin4

Share this

Relevant Blogs

The limitations of LLMs, or why are we doing RAG?

Despite powerful capabilities with many tasks, Large Language Models (LLMs) are not know-it-alls. If you've used ChatGPT or other models, you'll have experienced how they can’t reasonably answer questions about...
June 17, 2024

PGVector as Embedding Store in PrivateGPT

EDB has a long history of open source contributions, and while we’re best known for our contributions to Postgres, that’s not the only project we contribute to. e.g Barman, CloudNativePG...
June 05, 2024

More Blogs

Finding memory leaks in Postgres C code

I spent the last week looking for a memory leak in Postgres’s WAL Sender process. I spent a few days getting more acquainted with Valgrind and gcc/clang sanitizers, but ultimately...
March 27, 2024