Search code examples
databasepostgresqlauthenticationpgadmin-4

pgadmin4 allows login as admin user with wrong password

I created an admin user with password in pgadmin4:

CREATE USER admin WITH
LOGIN
SUPERUSER
CREATEDB
CREATEROLE
INHERIT
REPLICATION
CONNECTION LIMIT -1
PASSWORD 'xxxxxx';

But I can login to the respective server with the admin user and any wrong password. I used psql command line to check if the user has been created, and it is. 

# SELECT usename FROM pg_user;
usename   
------------
 postgres
 xxxxxxxxxxx
 admin
 (3 rows)

I checked if I can login with the admin user and a wrong password through psql command line, and it worked...

Am I doing something wrong?

Pgadmin4 v1.1
Postgresql v9.6
Same problem on Centos 6.8 and macOSX 19.12.1

Solution

  • This is speculation, but it's educated speculation, as I encountered a similar issue.

    If your pg_hba.conf file, I am pretty confident you have the admin user set up as "trust." This pretty much means it can log in from anywhere you specified, without a password.

    If you change this to "md5," it should resolve the issue.

    # TYPE  DATABASE        USER            ADDRESS                 METHOD
host    all             admin           <whatever>              trust

    change to

    host    all             admin           <whatever>              md5

    Of course some of these fields may be different, depending on how you have the server set up, but you get the idea.