为PgAdmin配置GitLab OAuth2时遇「Missing jwks_uri in metadata」错误

问题背景 #

参考Stack Overflow相关配置步骤，对接**自建GitLab（地址：https://gitlab_company_org）和Docker部署的PgAdmin实例（地址：http://pgadmin.projectx.company.org:8000）**时，点击GitLab登录按钮完成授权后，收到以下错误响应：

{"success":0,"errormsg":"Missing \"jwks_uri\" in metadata","info":"","result":null,"data":null}

触发错误的请求地址为：http://pgadmin.projectx.company.org:8000/oauth2/authorize?code=VERYLONGCODE&state=SOMEOTHERKINDOFCODE

当前配置 #

config_local.py #

AUTHENTICATION_SOURCES = ['oauth2', 'internal']
MASTER_PASSWORD = True
OAUTH2_CONFIG = [
    {
        'OAUTH2_NAME': 'gitlab',
        'OAUTH2_DISPLAY_NAME': 'Gitlab',
        'OAUTH2_CLIENT_ID': 'gitlab_client_id',
        'OAUTH2_CLIENT_SECRET': 'gitlab_client_secret',
        'OAUTH2_TOKEN_URL': 'https://gitlab_company_org/oauth/token',
        'OAUTH2_AUTHORIZATION_URL': 'https://gitlab_company_org/oauth/authorize',
        'OAUTH2_API_BASE_URL': 'https://gitlab_company_org/oauth/',
        'OAUTH2_USERINFO_ENDPOINT': 'userinfo',
        'OAUTH2_SCOPE': 'openid email profile',
        'OAUTH2_ICON': 'fa-gitlab',
        'OAUTH2_BUTTON_COLOR': '#E24329',
    }
]
OAUTH2_AUTO_CREATE_USER = True

run_pgadmin.sh #

mkdir -p ./pgadmin
mkdir -p ./pgadmin/data

touch ./pgadmin/config_local.py

chown -R 5050:5050 ./pgadmin

docker stop pgadmin
docker rm pgadmin

docker pull dpage/pgadmin4
docker run -p 8000:80 \
    --name pgadmin \
    -e 'PGADMIN_DEFAULT_EMAIL=pgadmin@company.org' \
    -e 'PGADMIN_DEFAULT_PASSWORD=somesupersecretsecret' \
    -e 'PGADMIN_CONFIG_LOGIN_BANNER="Authorised users only!"' \
    -v /opt/container/pgadmin/data:/var/lib/pgadmin \
    -v /opt/container/pgadmin/config_local.py:/pgadmin4/config_local.py:ro \
    -d dpage/pgadmin4

解决方案 #

感谢Aditya Toshniwal的帮助，通过以下调整即可解决问题：

1. 更换PgAdmin镜像为Docker Hub上的dpage/pgadmin4:snapshot或dpage/pgadmin4:2023-01-09-2（替换原dpage/pgadmin4镜像）
2. 在OAUTH2_CONFIG中添加OAUTH2_SERVER_METADATA_URL参数，值为自建GitLab的OpenID配置地址：https://gitlab_company_org/oauth/.well-known/openid-configuration

修改后的OAUTH2_CONFIG片段如下：

OAUTH2_CONFIG = [
    {
        'OAUTH2_NAME': 'gitlab',
        'OAUTH2_DISPLAY_NAME': 'Gitlab',
        'OAUTH2_CLIENT_ID': 'gitlab_client_id',
        'OAUTH2_CLIENT_SECRET': 'gitlab_client_secret',
        'OAUTH2_SERVER_METADATA_URL': 'https://gitlab_company_org/oauth/.well-known/openid-configuration',
        'OAUTH2_SCOPE': 'openid email profile',
        'OAUTH2_ICON': 'fa-gitlab',
        'OAUTH2_BUTTON_COLOR': '#E24329',
    }
]

调整完成后，自建GitLab与PgAdmin的OAuth2配置即可正常工作。

内容的提问来源于stack exchange，提问作者Crappy Betty