<p>I've deployed pgadmin on Kubernetes and I'm trying to enable oauth2 as per the <a href="https://www.pgadmin.org/docs/pgadmin4/5.5/oauth2.html" rel="nofollow noreferrer">pgadmin docs</a></p>
<p>This is the oauth config which I've passed in:</p>
<pre class="lang-py prettyprint-override"><code>AUTHENTICATION_SOURCES = ['oauth2', 'internal']

OAUTH2_CONFIG = [
    {
        # The name of the of the oauth provider, ex: github, google
        'OAUTH2_NAME': 'gitlab',
        # The display name, ex: Google
        'OAUTH2_DISPLAY_NAME': 'Gitlab',
        # Oauth client id
        'OAUTH2_CLIENT_ID': 'my-client-id-here',
        # Oauth secret
        'OAUTH2_CLIENT_SECRET': 'my-client-secret-here',
        # URL to generate a token,
        # Ex: https://github.com/login/oauth/access_token
        'OAUTH2_TOKEN_URL': 'https://gitlab.com/oauth/token',
        # URL is used for authentication,
        # Ex: https://github.com/login/oauth/authorize
        'OAUTH2_AUTHORIZATION_URL': &quot;https://gitlab.com/oauth/authorize&quot;,
        # Oauth base url, ex: https://api.github.com/
        'OAUTH2_API_BASE_URL': 'https://gitlab.com/api/v4/',
        # Name of the Endpoint, ex: user
        'OAUTH2_USERINFO_ENDPOINT': 'user',
        # Font-awesome icon, ex: fa-github
        'OAUTH2_ICON': 'fa-gitlab',
        # UI button colour, ex: #0000ff
        'OAUTH2_BUTTON_COLOR': '#E24329',
    }
]
OAUTH2_AUTO_CREATE_USER = True
</code></pre>
<p>I've added the application on Gitlab. The redirect URIs are:</p>
<pre><code>https://pgadmin.nonprod.example.io/oauth2/authorize
http://pgadmin.nonprod.example.io/oauth2/authorize
</code></pre>
<p>I've give the application the following scopes:</p>
<ul>
<li>api</li>
<li>openid</li>
<li>profile</li>
<li>email</li>
</ul>
<p>I'm testing it locally with the pgadmin ingress and my local minikube cluster. I keep getting the following error when I click the 'Sign in with Gitlab' button:</p>
<pre><code>{
success: 0,
errormsg: &quot;403 Client Error: Forbidden for url: https://gitlab.com/api/v4/user&quot;,
info: &quot;&quot;,
result: null,
data: null
}
</code></pre>
<p>I believe I have all the necessary gitlab permissions and can't figure out what I'm doing wrong.</p>

Alan
<p>I think that in this case we can just use the OIDC endpoint to fetch userinfo. For gitlab it is: ttps://gitlab.com/oauth/userinfo. Therefore, you do not need <code>api</code> scope, just <code>openid email profile</code></p>
<p>So the following configuration actually works for me:</p>
<pre class="lang-py prettyprint-override"><code>AUTHENTICATION_SOURCES = ['oauth2', 'internal']

OAUTH2_CONFIG = [
    {
        'OAUTH2_NAME': 'gitlab',
        'OAUTH2_DISPLAY_NAME': 'Gitlab',
        'OAUTH2_CLIENT_ID': 'my-client-id-here',
        'OAUTH2_CLIENT_SECRET': 'my-client-secret-here',
        'OAUTH2_TOKEN_URL': 'https://gitlab.com/oauth/token',
        'OAUTH2_AUTHORIZATION_URL': &quot;https://gitlab.com/oauth/authorize&quot;,
        'OAUTH2_API_BASE_URL': 'https://gitlab.com/oauth/',
        'OAUTH2_USERINFO_ENDPOINT': 'userinfo',
        'OAUTH2_SCOPE': 'openid email profile',
        'OAUTH2_ICON': 'fa-gitlab',
        'OAUTH2_BUTTON_COLOR': '#E24329',
    }
]
OAUTH2_AUTO_CREATE_USER = True
</code></pre>
