OAuth / OIDC Login

ECOSIRE builds that client for you. The core is a generic OpenID Connect provider record configured from a single issuer or .well-known/openid-configuration discovery URL, so onboarding a new provider is a matter of pasting one endpoint rather than hand-wiring authorize, token, JWKS, and userinfo URLs. On top of the discovery layer we ship provider presets for the identity platforms you are most likely to use, each rendering its own branded button on the Odoo sign-in page via QWeb template inheritance. Authentication runs the Authorization Code flow with PKCE — a hardening over Odoo's implicit-flow default — and the returned ID token is validated against the provider's JWKS endpoint, with automatic key-rotation handling so a routine key roll at the IdP never locks your users out.

Technically, the work lives in a clean-room addon with its own __manifest__.py declaring dependencies on base, web, and auth_oauth. Provider configuration is a new models.Model with fields for the issuer, client id, secret, scopes, and enforcement flags, plus @api.depends computes that derive endpoints from discovery. Access is locked down through ir.model.access.csv and record rules so only administrators read client secrets, and a token/claim inspection log lets you troubleshoot a failed login by seeing exactly which claims arrived — without ever exposing the secret. On each successful login the addon performs just-in-time user creation and profile sync (name, email, avatar) from OIDC claims, and applies claim-to-group mapping so a provider role or group membership translates into the correct Odoo security groups (res.groups) every time the user signs in. You can run multiple concurrent providers, restrict a provider to whitelisted email domains, fetch the userinfo endpoint for IdPs that issue thin ID tokens, and optionally enforce "SSO only" so matched users can no longer fall back to a password. Everything is built and tested for Odoo 17.0, 18.0, and 19.0, Community or Enterprise.

Because this is build-to-order, delivery follows a defined path rather than an instant download: a short scoping call to confirm your provider(s), the exact claims available in your tokens, and your group-mapping and enforcement rules; then we build against a spec, deliver to a staging database for UAT, and cut over with a rollback plan. Typical delivery is 2–4 weeks from confirmed scope. Pricing starts from $299 (indicative, single-company base scope); additional identity providers, complex claim-to-group and domain-restriction rules, multi-company or multi-database rollouts, and deeper enforcement/audit requirements increase the quoted scope. You receive a fixed quote after the scoping call — never a surprise.