Describe the bug
web/pgadmin/authenticate/oauth2.py:747 guards the userinfo request like this:
if 'OAUTH2_USERINFO_ENDPOINT' not in self.oauth2_config[...]:
...
'OAUTH2_USERINFO_ENDPOINT not configured for ...'
...
client.get(self.oauth2_config[self.oauth2_current_client]['OAUTH2_USERINFO_ENDPOINT'])
This tests key presence, not truthiness. But web/config.py:864 ships the OAUTH2_CONFIG template entry with:
'OAUTH2_USERINFO_ENDPOINT': None,
So a config copied from the shipped template (as documented) has the key present with a None value. The not in check passes (key exists), so the code proceeds to call client.get(None), which raises requests.exceptions.MissingSchema: Invalid URL 'None' instead of either working correctly (for an OIDC provider that supplies claims via ID token / discovery, where this endpoint genuinely isn't needed) or failing with the intended "not configured" message.
To Reproduce
- Configure
OAUTH2_CONFIG for an OIDC provider using OAUTH2_SERVER_METADATA_URL, leaving OAUTH2_USERINFO_ENDPOINT at its template default of None (rather than deleting the key).
- Log in via that provider.
- The userinfo fetch raises
MissingSchema: Invalid URL 'None' instead of skipping the call or falling back to discovery-resolved metadata.
Expected behavior
The check should test truthiness (if not self.oauth2_config[...].get('OAUTH2_USERINFO_ENDPOINT')) rather than key presence, so an explicit None is treated the same as an absent key.
Found while re-verifying #8804 (OIDC discovery) — the discovery mechanism itself works correctly, but this adjacent code path in the same login flow has a real crash for configs that follow the shipped template.
Describe the bug
web/pgadmin/authenticate/oauth2.py:747guards the userinfo request like this:This tests key presence, not truthiness. But
web/config.py:864ships theOAUTH2_CONFIGtemplate entry with:So a config copied from the shipped template (as documented) has the key present with a
Nonevalue. Thenot incheck passes (key exists), so the code proceeds to callclient.get(None), which raisesrequests.exceptions.MissingSchema: Invalid URL 'None'instead of either working correctly (for an OIDC provider that supplies claims via ID token / discovery, where this endpoint genuinely isn't needed) or failing with the intended "not configured" message.To Reproduce
OAUTH2_CONFIGfor an OIDC provider usingOAUTH2_SERVER_METADATA_URL, leavingOAUTH2_USERINFO_ENDPOINTat its template default ofNone(rather than deleting the key).MissingSchema: Invalid URL 'None'instead of skipping the call or falling back to discovery-resolved metadata.Expected behavior
The check should test truthiness (
if not self.oauth2_config[...].get('OAUTH2_USERINFO_ENDPOINT')) rather than key presence, so an explicitNoneis treated the same as an absent key.Found while re-verifying #8804 (OIDC discovery) — the discovery mechanism itself works correctly, but this adjacent code path in the same login flow has a real crash for configs that follow the shipped template.