Most teams reach a point where "one more Odoo password" is the problem, not the solution. Your staff already authenticate to Google Workspace, Microsoft/Entra, or a self-hosted identity server every morning, yet Odoo keeps its own separate credential store. Odoo Community ships auth_oauth, but out of the box it is geared toward a short list of hard-coded social providers and — critically — still leans on the OAuth2 implicit flow, which returns tokens directly in the browser URL fragment and does no cryptographic verification of the ID token against the provider's signing keys. For a modern enterprise IdP that speaks OpenID Connect, that native path is either brittle to configure or falls short of what your security team will sign off on. This is where teams run out of road: they want a real OIDC client, provider-agnostic, standards-correct, and mapped to their own Odoo groups — not a fixed menu of buttons.

ECOSIRE builds that client for you. The core is a generic OpenID Connect provider record configured from a single issuer or .well-known/openid-configuration discovery URL, so onboarding a new provider is a matter of pasting one endpoint rather than hand-wiring authorize, token, JWKS, and userinfo URLs. On top of the discovery layer we ship provider presets for the identity platforms you are most likely to use, each rendering its own branded button on the Odoo sign-in page via QWeb template inheritance. Authentication runs the Authorization Code flow with PKCE — a hardening over Odoo's implicit-flow default — and the returned ID token is validated against the provider's JWKS endpoint, with automatic key-rotation handling so a routine key roll at the IdP never locks your users out.

Technically, the work lives in a clean-room addon with its own __manifest__.py declaring dependencies on base, web, and auth_oauth. Provider configuration is a new models.Model with fields for the issuer, client id, secret, scopes, and enforcement flags, plus @api.depends computes that derive endpoints from discovery. Access is locked down through ir.model.access.csv and record rules so only administrators read client secrets, and a token/claim inspection log lets you troubleshoot a failed login by seeing exactly which claims arrived — without ever exposing the secret. On each successful login the addon performs just-in-time user creation and profile sync (name, email, avatar) from OIDC claims, and applies claim-to-group mapping so a provider role or group membership translates into the correct Odoo security groups (res.groups) every time the user signs in. You can run multiple concurrent providers, restrict a provider to whitelisted email domains, fetch the userinfo endpoint for IdPs that issue thin ID tokens, and optionally enforce "SSO only" so matched users can no longer fall back to a password. Everything is built and tested for Odoo 17.0, 18.0, and 19.0, Community or Enterprise.

Because this is build-to-order, delivery follows a defined path rather than an instant download: a short scoping call to confirm your provider(s), the exact claims available in your tokens, and your group-mapping and enforcement rules; then we build against a spec, deliver to a staging database for UAT, and cut over with a rollback plan. Typical delivery is one working week from confirmed scope. Pricing starts from $999 (indicative, single-company base scope); additional identity providers, complex claim-to-group and domain-restriction rules, multi-company or multi-database rollouts, and deeper enforcement/audit requirements increase the quoted scope. You receive a fixed quote after the scoping call — never a surprise.