pgadmin-org / pgadmin-org/pgadmin4

OAuth2: userinfo request crashes with MissingSchema when OAUTH2_USERINFO_ENDPOINT is present but None

Open Beginner friendly
#10,349 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Describe the bug

web/pgadmin/authenticate/oauth2.py:747 guards the userinfo request like this:

if 'OAUTH2_USERINFO_ENDPOINT' not in self.oauth2_config[...]:
    ...
    'OAUTH2_USERINFO_ENDPOINT not configured for ...'
...
client.get(self.oauth2_config[self.oauth2_current_client]['OAUTH2_USERINFO_ENDPOINT'])

This tests key presence, not truthiness. But web/config.py:864 ships the OAUTH2_CONFIG template entry with:

'OAUTH2_USERINFO_ENDPOINT': None,

So a config copied from the shipped template (as documented) has the key present with a None value. The not in check passes (key exists), so the code proceeds to call client.get(None), which raises requests.exceptions.MissingSchema: Invalid URL 'None' instead of either working correctly (for an OIDC provider that supplies claims via ID token / discovery, where this endpoint genuinely isn't needed) or failing with the intended "not configured" message.

To Reproduce

  1. Configure OAUTH2_CONFIG for an OIDC provider using OAUTH2_SERVER_METADATA_URL, leaving OAUTH2_USERINFO_ENDPOINT at its template default of None (rather than deleting the key).
  2. Log in via that provider.
  3. The userinfo fetch raises MissingSchema: Invalid URL 'None' instead of skipping the call or falling back to discovery-resolved metadata.

Expected behavior

The check should test truthiness (if not self.oauth2_config[...].get('OAUTH2_USERINFO_ENDPOINT')) rather than key presence, so an explicit None is treated the same as an absent key.

Found while re-verifying #8804 (OIDC discovery) — the discovery mechanism itself works correctly, but this adjacent code path in the same login flow has a real crash for configs that follow the shipped template.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in web/pgadmin/authenticate/oauth2.py around line 747 and compare the userinfo guard with the OAUTH2_CONFIG template in web/config.py around line 864. Reproduce the OIDC configuration with OAUTH2_USERINFO_ENDPOINT set to None, then verify the userinfo request no longer raises MissingSchema and that an absent or false endpoint follows the intended unconfigured behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.