pgadmin-org / pgadmin-org/pgadmin4
OAuth2: userinfo request crashes with MissingSchema when OAUTH2_USERINFO_ENDPOINT is present but None
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Describe the bug
web/pgadmin/authenticate/oauth2.py:747 guards the userinfo request like this:
if 'OAUTH2_USERINFO_ENDPOINT' not in self.oauth2_config[...]:
...
'OAUTH2_USERINFO_ENDPOINT not configured for ...'
...
client.get(self.oauth2_config[self.oauth2_current_client]['OAUTH2_USERINFO_ENDPOINT'])
This tests key presence, not truthiness. But web/config.py:864 ships the OAUTH2_CONFIG template entry with:
'OAUTH2_USERINFO_ENDPOINT': None,
So a config copied from the shipped template (as documented) has the key present with a None value. The not in check passes (key exists), so the code proceeds to call client.get(None), which raises requests.exceptions.MissingSchema: Invalid URL 'None' instead of either working correctly (for an OIDC provider that supplies claims via ID token / discovery, where this endpoint genuinely isn't needed) or failing with the intended "not configured" message.
To Reproduce
- Configure
OAUTH2_CONFIGfor an OIDC provider usingOAUTH2_SERVER_METADATA_URL, leavingOAUTH2_USERINFO_ENDPOINTat its template default ofNone(rather than deleting the key). - Log in via that provider.
- The userinfo fetch raises
MissingSchema: Invalid URL 'None'instead of skipping the call or falling back to discovery-resolved metadata.
Expected behavior
The check should test truthiness (if not self.oauth2_config[...].get('OAUTH2_USERINFO_ENDPOINT')) rather than key presence, so an explicit None is treated the same as an absent key.
Found while re-verifying #8804 (OIDC discovery) — the discovery mechanism itself works correctly, but this adjacent code path in the same login flow has a real crash for configs that follow the shipped template.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in web/pgadmin/authenticate/oauth2.py around line 747 and compare the userinfo guard with the OAUTH2_CONFIG template in web/config.py around line 864. Reproduce the OIDC configuration with OAUTH2_USERINFO_ENDPOINT set to None, then verify the userinfo request no longer raises MissingSchema and that an absent or false endpoint follows the intended unconfigured behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100