Use Ionize as OIDC IdP for pgAdmin

This recipe is built into Ionize, pgAdmin SSO via Ionize IAM is a default-on feature. See Security, pgAdmin SSO for the full reference.

What's already wired up

The compose file includes a pgAdmin container with OAuth2 SSO pre-configured:

pgAdmin auth source = OAuth2.
Issuer = IAM Hydra.
Role claim = dba_role (from Kratos identity trait).

What you need to do

1. Set the `dba_role` trait on your IAM identity

In Dashboard IAM → Identities → your identity → Edit traits:

"dba_role": "ionize_app_admin"

Valid values are the Postgres role names you've configured: ionize_readonly, ionize_app_admin, etc.

2. Create the matching Postgres role

If the role doesn't exist yet:

CREATE ROLE ionize_app_admin LOGIN PASSWORD '<random>';
GRANT CONNECT ON DATABASE ionize TO ionize_app_admin;
GRANT USAGE ON SCHEMA public TO ionize_app_admin;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ionize_app_admin;

See Security, pgAdmin DBA accounts for the canonical grants per role tier.

3. Log in

Open https://pgadmin.<your-domain>. Click Login with Ionize. Authenticate via IAM Auth. Land in pgAdmin connected as your dba_role.

Offboarding

When an engineer leaves:

Dashboard IAM → Identities → their identity → Delete (or set state: deactivated).
Their OIDC session expires.
Postgres role is automatically unmapped (because the role mapping is dynamic at login time).
Optionally: keep their identity in deactivated state for audit-log continuity.

See Operate, pgAdmin DBA offboarding for the full runbook.