Database Management

X-Forwarded-User / REMOTE_USER

Zero-Day Shield

SSO + Zero-Day Protection for pgAdmin

by pgAdmin Development Team

Secure pgAdmin with SAML/OIDC SSO — Authenticated Proxy Protection for Database Administration

Overview

Why pgAdmin Needs an Authenticated Proxy

pgAdmin is the most popular open-source administration tool for PostgreSQL databases. It provides a web-based interface for database management, SQL query execution, schema design, and server monitoring. A compromised pgAdmin instance gives attackers direct access to production databases — the ability to read, modify, or delete business-critical data. Despite the severity of this risk, many pgAdmin deployments rely on basic username/password authentication with no MFA, no SSO, and no audit trail. OnePAM adds enterprise-grade security to pgAdmin by placing an authenticated reverse proxy in front of it. Users authenticate through your corporate IdP, and OnePAM handles the session injection. Only verified, authorized users can reach pgAdmin, and every database administration session is logged and optionally recorded.

HTTP Header Authentication

X-Forwarded-User / REMOTE_USER

pgAdmin supports external authentication via the REMOTE_USER header when deployed behind a trusted reverse proxy. OnePAM injects the authenticated user identity, and pgAdmin creates the session accordingly.

Zero-Day Risk Profile

pgAdmin Vulnerability Risks

Without an authenticated proxy, these risks are directly exploitable by any network-reachable attacker.

pgAdmin has had critical path traversal and code execution vulnerabilities

Direct access to production databases enables data exfiltration or destruction

SQL query execution capabilities can be used for privilege escalation

Server credentials stored in pgAdmin expose all managed PostgreSQL instances

The Challenge

Security Challenges with pgAdmin

These are the risks organizations face when pgAdmin is not behind an authenticated proxy.

Production Database Access

pgAdmin provides direct SQL execution against production databases. Unauthorized access means unrestricted ability to read, modify, or delete data.

Weak Default Authentication

pgAdmin's built-in authentication is basic username/password with no MFA support. Many deployments have no authentication at all on internal networks.

Stored Server Credentials

pgAdmin stores connection credentials for PostgreSQL servers. A compromised instance exposes passwords for all managed databases.

No Audit Trail

pgAdmin provides minimal logging of who executed which queries. Reconstructing database administration activities for compliance is nearly impossible.

No Native SSO

pgAdmin has no built-in SAML or OIDC support. Integrating with corporate identity infrastructure requires external solutions.

Multi-User Management

Managing individual pgAdmin accounts for database administrators creates credential overhead without centralized identity controls.

The OnePAM Solution

How OnePAM Adds SSO + Zero-Day Protection to pgAdmin

A step-by-step guide to deploying OnePAM's authenticated proxy in front of pgAdmin.

Deploy OnePAM in Front of pgAdmin

Place OnePAM as the reverse proxy handling all HTTPS traffic to your pgAdmin instance.

pgAdmin is configured to listen on localhost only. OnePAM becomes the sole network entry point, enforcing authentication on every request.

Connect Your Identity Provider

Configure your corporate IdP — Okta, Azure AD, Google Workspace, or any SAML/OIDC provider.

OnePAM handles IdP federation, MFA enforcement, and session management.

Enable Proxy Authentication

Configure pgAdmin to trust the REMOTE_USER header from OnePAM for automatic session creation.

pgAdmin accepts the pre-authenticated identity from OnePAM's header injection and creates a user session without showing a login page.

Restrict Database Access

Define policies for who can access pgAdmin and which database servers they can manage.

DBAs get full access, developers get read-only access to staging, and analysts get access only to reporting databases — all controlled from your IdP groups.

Record and Audit

Every pgAdmin session is logged with IdP context. Session recording captures SQL queries and schema changes.

Compliance teams can review exactly who accessed which database, when, from where, and what queries they executed. Session recordings provide visual evidence for audits.

Business Impact

Benefits of Securing pgAdmin with OnePAM

Measurable security and operational outcomes from deploying OnePAM in front of pgAdmin.

Protect Production Databases

Only authenticated, authorized users can reach pgAdmin. No anonymous access to database administration tools.

Zero unauthorized database access

Enterprise SSO for pgAdmin

Database administrators authenticate with their corporate credentials — no separate pgAdmin passwords.

Single identity for DB admin

MFA for Database Administration

Require multi-factor authentication before any database administration session can begin.

100% MFA-protected DB access

Complete Query Audit Trail

Session recording captures every SQL query, schema change, and data export for compliance and forensics.

Full forensic visibility

Shield from pgAdmin CVEs

Path traversal and code execution vulnerabilities in pgAdmin are unexploitable without authenticated access.

CVEs blocked at proxy layer

Instant Access Revocation

When a DBA leaves, disable them in your IdP and pgAdmin access stops immediately.

Real-time deprovisioning

SSO Features

pgAdmin SSO Capabilities

Every feature needed to provide enterprise-grade SSO and access control for pgAdmin.

SAML 2.0 & OIDC SSO via REMOTE_USER header

Automatic user provisioning from IdP

Role-based pgAdmin access from IdP groups

Session recording for SQL query auditing

IP and geo-restriction for database access

Device trust verification

Time-limited access windows for contractors

Concurrent session controls

Server credential isolation from end users

Emergency break-glass access procedures

Security

Zero-Day Protection Features

Enterprise-grade security controls that shield pgAdmin from exploitation.

pgAdmin isolated from direct network access

End-to-end TLS encryption

Request-level identity verification

Protection against pgAdmin path traversal CVEs

Database connection credential protection

Automatic session termination on IdP sign-out

Real-World Scenarios

pgAdmin SSO + Security Use Cases

Common scenarios where organizations deploy OnePAM in front of pgAdmin.

Database administrators accessing production PostgreSQL via corporate SSO with MFA

Developers accessing staging databases with read-only pgAdmin access

Analysts running reports against data warehouses with time-limited, audited sessions

External DBAs providing support with recorded, time-limited access

Compliance-driven database administration auditing for SOX and HIPAA

Protecting pgAdmin from network-based exploitation in hybrid cloud environments

Frequently Asked Questions

pgAdmin SSO + Security FAQ

Common questions about deploying OnePAM's authenticated proxy for pgAdmin.

Does OnePAM require changes to pgAdmin configuration?

Minimal. You configure pgAdmin to use REMOTE_USER authentication (a one-time setting change) and ensure pgAdmin only listens on localhost. OnePAM handles the rest.

Can different users see different PostgreSQL servers?

Yes. OnePAM's identity-aware policies combined with pgAdmin's server group permissions allow you to control which database servers each user or group can access.

Does session recording capture SQL queries?

Yes. OnePAM's session recording captures the entire web interaction including SQL queries typed in pgAdmin's query editor, schema changes, and data exports.

Can we use OnePAM with pgAdmin in Desktop mode?

OnePAM protects pgAdmin in server (web) mode. For Desktop mode, consider deploying pgAdmin as a web application and routing access through OnePAM for consistent security.

What about automated database scripts and cron jobs?

Automated scripts should connect to PostgreSQL directly using service accounts, not through pgAdmin. OnePAM protects the interactive pgAdmin interface while automated processes use direct database connections.

Ready to Secure pgAdmin with SSO + Zero-Day Protection?

Deploy OnePAM in minutes — no pgAdmin code changes required. Start your free 14-day trial today.

Start Free Trial View All Supported Apps