配置 pgadmin4 以使用 Azure AD Oauth2

Question

I'm trying to add possibility to login into pgadmin4 panel with Azure AD Oauth2. I created app in App registrations , created secrets in Certificates & secrets and in config_local.py I have settings like:

    MASTER_PASSWORD_REQUIRED = True
    AUTHENTICATION_SOURCES = ['oauth2', 'internal']
    OAUTH2_AUTO_CREATE_USER = True
    OAUTH2_CONFIG = [
      {
          'OAUTH2_NAME': 'azure',
          'OAUTH2_DISPLAY_NAME': 'azure',
          'OAUTH2_CLIENT_ID': 'Application (client) ID',
          'OAUTH2_CLIENT_SECRET': '{SECRET_VALUE}',
          'OAUTH2_TOKEN_URL': 'https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token',
          'OAUTH2_AUTHORIZATION_URL': 'https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/authorize',
          'OAUTH2_API_BASE_URL': 'https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/authorize',
          'OAUTH2_USERINFO_ENDPOINT': 'userinfo',
          'OAUTH2_BUTTON_COLOR': '#0000ff',
      }
    ]

I have an option on my login page to log into the panel with azure, but when I go there I get:

AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope email profile is not valid. openid scope is required.

From where should I take the scope?

Answer 1

The error AADSTS70011 usually occurs if you missed including scopes or provided invalid scopes.

You can add those scopes for your Azure AD application like below:

Go to Azure Portal -> Azure Active Directory -> App registration -> Your App -> API permissions -> Add a permission

UPDATE:

Based on the query, you need to add the scopes with spaces between them as a value for OAUTH2_SCOPE parameter.

For suppose if you are trying to read user profile, you need to include "User.Read" also like below:

 'OAUTH2_SCOPE': 'User.Read openid email profile' 

In addition to that, you need to change OAUTH2_API_BASE_URL and OAUTH2_USERINFO_ENDPOINT values too like below as Azure is your provider:

'OAUTH2_API_BASE_URL': 'https://graph.microsoft.com/v1.0/', // Oauth base url

'OAUTH2_USERINFO_ENDPOINT': 'me', // Name of endpoint

To resolve the error, you need to modify your config_local.py file settings like below:

    MASTER_PASSWORD_REQUIRED = True
    AUTHENTICATION_SOURCES = ['oauth2', 'internal']
    OAUTH2_AUTO_CREATE_USER = True
    OAUTH2_CONFIG = [
      {
          'OAUTH2_NAME': 'azure',
          'OAUTH2_DISPLAY_NAME': 'azure',
          'OAUTH2_CLIENT_ID': 'Application (client) ID',
          'OAUTH2_CLIENT_SECRET': '{SECRET_VALUE}',
          'OAUTH2_TOKEN_URL': 'https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token',
          'OAUTH2_AUTHORIZATION_URL': 'https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/authorize',
          'OAUTH2_API_BASE_URL': 'https://graph.microsoft.com/v1.0/',
          'OAUTH2_USERINFO_ENDPOINT': 'me',
          'OAUTH2_SCOPE': 'User.Read openid email profile' //Make sure to add User.Read in Portal too
          'OAUTH2_BUTTON_COLOR': '#0000ff',
      }
    ]

Make sure to add Redirect URL in your Azure AD application as https://<your pgAdmin Server URL>/oauth2/authorize

CREDIT: How to Configure OAuth 2.0 with Azure AD in pgAdmin4 | by Asmita Thapliyal