Skip to content

fix: don't crash every request when auth_source_manager is None in the session #10734

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Rarasinhoo wants to merge 3 commits into from
Closed

fix: don't crash every request when auth_source_manager is None in the session #10734

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
245b3aa
fix: don't crash every request when auth_source_manager is None in th…
Rarasinhoo Nov 4, 2026
94313fa
fix: treat a None auth_source_manager as an unknown source so the res…
Rarasinhoo Nov 4, 2026
132ff54
fix: keep an authenticated user's auth source while a new login is pe…
Rarasinhoo Nov 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions web/pgadmin/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1004,11 +1004,12 @@ def before_request():
return response
# if the server is restarted the in memory key will be lost
# but the user session may still be active. Logout the user
# to get the key again when login
# to get the key again when login. auth_source_manager is None while
# an OAuth2 login is pending: treat it as an unknown source.
if config.SERVER_MODE and current_user.is_authenticated and \
'auth_source_manager' in session and \
session['auth_source_manager']['current_source'] not in \
[KERBEROS, OAUTH2, WEBSERVER] and \
(session['auth_source_manager'] or {}).get('current_source') \
not in [KERBEROS, OAUTH2, WEBSERVER] and \
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
current_app.keyManager.get() is None and \
request.endpoint not in ('security.login', 'security.logout'):
logout_user()
Expand Down
5 changes: 4 additions & 1 deletion web/pgadmin/authenticate/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,10 @@ def _login():
auth_obj = AuthSourceManager(form, copy.deepcopy(
config.AUTHENTICATION_SOURCES))

session['auth_source_manager'] = None
# An authenticated user keeps their current source until the new login
# succeeds: every request reads it, and None would break them.
if not current_user.is_authenticated:
session['auth_source_manager'] = None

# The internal account whose password Flask-Security checks: it is
# looked up the same way, by email and ignoring case.
Expand Down
Loading