Skip to content

Commit 06c1bed

Browse files
OCA-git-botOCA-git-bot
committed
Merge PR #705 into 18.0
Signed-off-by sbidoul
2 parents d1833a2 + bebe25c commit 06c1bed

34 files changed

+4168
-0
lines changed

‎auth_oidc/README.rst

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
=============================
2+
Authentication OpenID Connect
3+
=============================
4+
5+
..
6+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
7+
!! This file is generated by oca-gen-addon-readme !!
8+
!! changes will be overwritten. !!
9+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
10+
!! source digest: sha256:e65c1c978ca0266a8e54f8121675cbf710359cf407413e35518f670be9c9753f
11+
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
12+
13+
.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
14+
:target: https://odoo-community.org/page/development-status
15+
:alt: Beta
16+
.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
17+
:target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
18+
:alt: License: AGPL-3
19+
.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github
20+
:target: https://github.com/OCA/server-auth/tree/18.0/auth_oidc
21+
:alt: OCA/server-auth
22+
.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
23+
:target: https://translation.odoo-community.org/projects/server-auth-18-0/server-auth-18-0-auth_oidc
24+
:alt: Translate me on Weblate
25+
.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
26+
:target: https://runboat.odoo-community.org/builds?repo=OCA/server-auth&target_branch=18.0
27+
:alt: Try me on Runboat
28+
29+
|badge1| |badge2| |badge3| |badge4| |badge5|
30+
31+
This module allows users to login through an OpenID Connect provider
32+
using the authorization code flow or implicit flow.
33+
34+
Note the implicit flow is not recommended because it exposes access
35+
tokens to the browser and in http logs.
36+
37+
**Table of contents**
38+
39+
.. contents::
40+
:local:
41+
42+
Installation
43+
============
44+
45+
This module depends on the
46+
`python-jose <https://pypi.org/project/python-jose/>`__ library, not to
47+
be confused with ``jose`` which is also available on PyPI.
48+
49+
Configuration
50+
=============
51+
52+
Setup for Microsoft Azure
53+
-------------------------
54+
55+
Example configuration with OpenID Connect authorization code flow.
56+
57+
1. configure a new web application in Azure with OpenID and code flow
58+
(see the `provider
59+
documentation <https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/configure-openid-provider>`__))
60+
61+
2. in this application the redirect url must be be "<url of your
62+
server>/auth_oauth/signin" and of course this URL should be reachable
63+
from Azure
64+
65+
3. create a new authentication provider in Odoo with the following
66+
parameters (see the `portal
67+
documentation <https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/configure-openid-settings>`__
68+
for more information):
69+
70+
|image|
71+
72+
|image1|
73+
74+
Single tenant provider limits the access to user of your tenant, while
75+
Multitenants allow access for all AzureAD users, so user of foreign
76+
companies can use their AzureAD login without an guest account.
77+
78+
- Provider Name: Azure AD Single Tenant
79+
- Client ID: Application (client) id
80+
- Client Secret: Client secret
81+
- Allowed: yes
82+
83+
or
84+
85+
- Provider Name: Azure AD Multitenant
86+
- Client ID: Application (client) id
87+
- Client Secret: Client secret
88+
- Allowed: yes
89+
- replace {tenant_id} in urls with your Azure tenant id
90+
91+
|image2|
92+
93+
Setup for Keycloak
94+
------------------
95+
96+
Example configuration with OpenID Connect authorization code flow.
97+
98+
In Keycloak:
99+
100+
1. configure a new Client
101+
2. make sure Authorization Code Flow is Enabled.
102+
3. configure the client Access Type as "confidential" and take note of
103+
the client secret in the Credentials tab
104+
4. configure the redirect url to be "<url of your
105+
server>/auth_oauth/signin"
106+
107+
In Odoo, create a new Oauth Provider with the following parameters:
108+
109+
- Provider name: Keycloak (or any name you like that identify your
110+
keycloak provider)
111+
- Auth Flow: OpenID Connect (authorization code flow)
112+
- Client ID: the same Client ID you entered when configuring the client
113+
in Keycloak
114+
- Client Secret: found in keycloak on the client Credentials tab
115+
- Allowed: yes
116+
- Body: the link text to appear on the login page, such as Login with
117+
Keycloak
118+
- Scope: openid email
119+
- Authentication URL: The "authorization_endpoint" URL found in the
120+
OpenID Endpoint Configuration of your Keycloak realm
121+
- Token URL: The "token_endpoint" URL found in the OpenID Endpoint
122+
Configuration of your Keycloak realm
123+
- JWKS URL: The "jwks_uri" URL found in the OpenID Endpoint
124+
Configuration of your Keycloak realm
125+
126+
.. |image| image:: https://raw.githubusercontent.com/OCA/server-auth/18.0/auth_oidc/static/description/oauth-microsoft_azure-api_permissions.png
127+
.. |image1| image:: https://raw.githubusercontent.com/OCA/server-auth/18.0/auth_oidc/static/description/oauth-microsoft_azure-optional_claims.png
128+
.. |image2| image:: https://raw.githubusercontent.com/OCA/server-auth/18.0/auth_oidc/static/description/odoo-azure_ad_multitenant.png
129+
130+
Usage
131+
=====
132+
133+
On the login page, click on the authentication provider you configured.
134+
135+
Known issues / Roadmap
136+
======================
137+
138+
- When going to the login screen, check for a existing token and do a
139+
direct login without the clicking on the SSO link
140+
- When doing a logout an extra option to also logout at the SSO
141+
provider.
142+
143+
Changelog
144+
=========
145+
146+
18.0.1.0.0 2024-10-09
147+
---------------------
148+
149+
- Odoo 18 migration
150+
151+
17.0.1.0.0 2024-03-20
152+
---------------------
153+
154+
- Odoo 17 migration
155+
156+
16.0.1.1.0 2024-02-28
157+
---------------------
158+
159+
- Forward port OpenID Connect fixes from 15.0 to 16.0
160+
161+
16.0.1.0.2 2023-11-16
162+
---------------------
163+
164+
- Readme link updates
165+
166+
16.0.1.0.1 2023-10-09
167+
---------------------
168+
169+
- Add AzureAD code flow provider
170+
171+
16.0.1.0.0 2023-01-27
172+
---------------------
173+
174+
- Odoo 16 migration
175+
176+
15.0.1.0.0 2023-01-06
177+
---------------------
178+
179+
- Odoo 15 migration
180+
181+
14.0.1.0.0 2021-12-10
182+
---------------------
183+
184+
- Odoo 14 migration
185+
186+
13.0.1.0.0 2020-04-10
187+
---------------------
188+
189+
- Odoo 13 migration, add authorization code flow.
190+
191+
10.0.1.0.0 2018-10-05
192+
---------------------
193+
194+
- Initial implementation
195+
196+
Bug Tracker
197+
===========
198+
199+
Bugs are tracked on `GitHub Issues <https://github.com/OCA/server-auth/issues>`_.
200+
In case of trouble, please check there if your issue has already been reported.
201+
If you spotted it first, help us to smash it by providing a detailed and welcomed
202+
`feedback <https://github.com/OCA/server-auth/issues/new?body=module:%20auth_oidc%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
203+
204+
Do not contact contributors directly about support or help with technical issues.
205+
206+
Credits
207+
=======
208+
209+
Authors
210+
-------
211+
212+
* ICTSTUDIO
213+
* André Schenkels
214+
* ACSONE SA/NV
215+
216+
Contributors
217+
------------
218+
219+
- Alexandre Fayolle <[email protected]>
220+
- Stéphane Bidoul <[email protected]>
221+
- David Jaen <[email protected]>
222+
- Andreas Perhab <[email protected]>
223+
224+
Maintainers
225+
-----------
226+
227+
This module is maintained by the OCA.
228+
229+
.. image:: https://odoo-community.org/logo.png
230+
:alt: Odoo Community Association
231+
:target: https://odoo-community.org
232+
233+
OCA, or the Odoo Community Association, is a nonprofit organization whose
234+
mission is to support the collaborative development of Odoo features and
235+
promote its widespread use.
236+
237+
.. |maintainer-sbidoul| image:: https://github.com/sbidoul.png?size=40px
238+
:target: https://github.com/sbidoul
239+
:alt: sbidoul
240+
241+
Current `maintainer <https://odoo-community.org/page/maintainer-role>`__:
242+
243+
|maintainer-sbidoul|
244+
245+
This module is part of the `OCA/server-auth <https://github.com/OCA/server-auth/tree/18.0/auth_oidc>`_ project on GitHub.
246+
247+
You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

‎auth_oidc/__init__.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Copyright 2016 ICTSTUDIO <http://www.ictstudio.eu>
2+
# License: AGPL-3.0 or later (http://www.gnu.org/licenses/agpl)
3+
4+
from . import controllers
5+
from . import models

‎auth_oidc/__manifest__.py

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright 2016 ICTSTUDIO <http://www.ictstudio.eu>
2+
# Copyright 2021 ACSONE SA/NV <https://acsone.eu>
3+
# License: AGPL-3.0 or later (http://www.gnu.org/licenses/agpl)
4+
5+
{
6+
"name": "Authentication OpenID Connect",
7+
"version": "18.0.1.0.0",
8+
"license": "AGPL-3",
9+
"author": (
10+
"ICTSTUDIO, André Schenkels, "
11+
"ACSONE SA/NV, "
12+
"Odoo Community Association (OCA)"
13+
),
14+
"maintainers": ["sbidoul"],
15+
"website": "https://github.com/OCA/server-auth",
16+
"summary": "Allow users to login through OpenID Connect Provider",
17+
"external_dependencies": {"python": ["python-jose"]},
18+
"depends": ["auth_oauth"],
19+
"data": ["views/auth_oauth_provider.xml", "data/auth_oauth_data.xml"],
20+
"demo": ["demo/local_keycloak.xml"],
21+
}

‎auth_oidc/controllers/__init__.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Copyright 2016 ICTSTUDIO <http://www.ictstudio.eu>
2+
# License: AGPL-3.0 or later (http://www.gnu.org/licenses/agpl)
3+
4+
from . import main

‎auth_oidc/controllers/main.py

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Copyright 2016 ICTSTUDIO <http://www.ictstudio.eu>
2+
# Copyright 2021 ACSONE SA/NV <https://acsone.eu>
3+
# License: AGPL-3.0 or later (http://www.gnu.org/licenses/agpl)
4+
5+
import base64
6+
import hashlib
7+
import logging
8+
import secrets
9+
10+
from werkzeug.urls import url_decode, url_encode
11+
12+
from odoo.addons.auth_oauth.controllers.main import OAuthLogin
13+
14+
_logger = logging.getLogger(__name__)
15+
16+
17+
class OpenIDLogin(OAuthLogin):
18+
def list_providers(self):
19+
providers = super().list_providers()
20+
for provider in providers:
21+
flow = provider.get("flow")
22+
if flow in ("id_token", "id_token_code"):
23+
params = url_decode(provider["auth_link"].split("?")[-1])
24+
# nonce
25+
params["nonce"] = secrets.token_urlsafe()
26+
# response_type
27+
if flow == "id_token":
28+
# https://openid.net/specs/openid-connect-core-1_0.html
29+
# #ImplicitAuthRequest
30+
params["response_type"] = "id_token token"
31+
elif flow == "id_token_code":
32+
# https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
33+
params["response_type"] = "code"
34+
# PKCE (https://tools.ietf.org/html/rfc7636)
35+
code_verifier = provider["code_verifier"]
36+
code_challenge = base64.urlsafe_b64encode(
37+
hashlib.sha256(code_verifier.encode("ascii")).digest()
38+
).rstrip(b"=")
39+
params["code_challenge"] = code_challenge
40+
params["code_challenge_method"] = "S256"
41+
# scope
42+
if provider.get("scope"):
43+
if "openid" not in provider["scope"].split():
44+
_logger.error("openid connect scope must contain 'openid'")
45+
params["scope"] = provider["scope"]
46+
# auth link that the user will click
47+
provider["auth_link"] = "{}?{}".format(
48+
provider["auth_endpoint"], url_encode(params)
49+
)
50+
return providers

‎auth_oidc/data/auth_oauth_data.xml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<odoo noupdate="1">
3+
<record id="provider_azuread_multi" model="auth.oauth.provider">
4+
<field name="name">Azure AD Multitenant</field>
5+
<field name="flow">id_token_code</field>
6+
<field name="enabled">False</field>
7+
<field name="token_map">upn:user_id upn:email</field>
8+
<field
9+
name="auth_endpoint"
10+
>https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize</field>
11+
<field name="scope">profile openid</field>
12+
<field
13+
name="token_endpoint"
14+
>https://login.microsoftonline.com/organizations/oauth2/v2.0/token</field>
15+
<field
16+
name="jwks_uri"
17+
>https://login.microsoftonline.com/organizations/discovery/v2.0/keys</field>
18+
<field name="css_class">fa fa-fw fa-windows</field>
19+
<field name="body">Log in with Microsoft</field>
20+
</record>
21+
<record id="provider_azuread_single" model="auth.oauth.provider">
22+
<field name="name">Azure AD Single Tenant</field>
23+
<field name="flow">id_token_code</field>
24+
<field name="enabled">False</field>
25+
<field name="token_map">upn:user_id upn:email</field>
26+
<field
27+
name="auth_endpoint"
28+
>https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize</field>
29+
<field name="scope">profile openid</field>
30+
<field
31+
name="token_endpoint"
32+
>https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token</field>
33+
<field
34+
name="jwks_uri"
35+
>https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys</field>
36+
<field name="css_class">fa fa-fw fa-windows</field>
37+
<field name="body">Log in with Microsoft</field>
38+
</record>
39+
</odoo>

‎auth_oidc/demo/local_keycloak.xml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<odoo>
2+
<record id="local_keycloak" model="auth.oauth.provider">
3+
<field name="name">keycloak:8080 on localhost</field>
4+
<field name="flow">id_token_code</field>
5+
<field name="client_id">auth_oidc-test</field>
6+
<field name="token_map">preferred_username:user_id</field>
7+
<field name="body">keycloak:8080 on localhost</field>
8+
<field name="enabled" eval="True" />
9+
<field name="scope">openid email</field>
10+
<field
11+
name="auth_endpoint"
12+
>http://localhost:8080/auth/realms/master/protocol/openid-connect/auth</field>
13+
<field
14+
name="token_endpoint"
15+
>http://localhost:8080/auth/realms/master/protocol/openid-connect/token</field>
16+
<field
17+
name="jwks_uri"
18+
>http://localhost:8080/auth/realms/master/protocol/openid-connect/certs</field>
19+
</record>
20+
</odoo>

0 commit comments

Comments
 (0)