SAML 2.0 Single Sign-On

ECOSIRE delivers a clean-room SAML 2.0 Service Provider implemented on the standards-compliant python3-saml toolkit, packaged as a proper Odoo module with its own __manifest__.py, ORM models (models.Model with fields, @api.depends computes), ir.model.access.csv plus record rules, and OWL/XML configuration views. It plugs into Odoo's authentication pipeline so both SP-initiated login (user starts at Odoo, gets redirected to the IdP) and IdP-initiated login (user launches Odoo from their IdP dashboard) work against the same Assertion Consumer Service (ACS) endpoint. You configure each IdP by pasting its metadata URL or XML — Azure AD, Okta, Google Workspace, OneLogin, or any conformant SAML 2.0 provider — and the module ingests entity ID, SSO/SLO endpoints, and signing certificates automatically.

Under the hood the build handles the parts that make SAML safe rather than merely functional: signed AuthnRequest generation, signature verification and optional decryption of returned assertions, audience/recipient validation, clock-skew tolerance, and replay protection so a captured assertion cannot be re-presented. SP certificate and key material are managed from the Odoo UI, and the module exposes downloadable SP metadata plus the ACS and entity-ID endpoints so your IdP admin can register Odoo in minutes. On successful login the configurable attribute mapping drives just-in-time provisioning — new res.users records are created from IdP attributes on first login — and an attribute-to-group map re-evaluates Odoo security groups on every authentication, so a change to a user's IdP role or group takes effect the next time they sign in. Single Logout (SLO), per-IdP email-domain allow-lists, an optional "SSO required" mode that disables local password login for mapped users, configurable login-button branding on the sign-in screen, and per-assertion login audit entries round out the feature set. A guarded local-admin fallback URL ensures your administrators are never locked out if the IdP is unreachable.

Because this is a made-to-order build and not an off-the-shelf download, delivery starts with a short scoping call to confirm your IdP(s), attribute schema, group-mapping rules, provisioning policy, and target Odoo version and edition (Community vs Enterprise, 17.0 / 18.0 / 19.0). We then build and unit-test against your scope, stand it up on a staging instance for UAT with your real IdP metadata, and cut over to production with a documented rollback. Typical delivery is 2–4 weeks from confirmed scope, depending on the number of identity providers and the complexity of your group model.

Pricing starts from $399 (indicative, single-company base scope with one identity provider); additional IdP integrations, multi-company or multi-database SSO topologies, complex attribute-to-group rule sets, and custom provisioning or deprovisioning logic increase the quoted scope. You receive a fixed quote after the scoping call.