OdooWiki OCA HUB

Authentication OpenID Connect

auth_oidc folder_open OCA/server-auth open_in_new
Uncategorised License: AGPL-3

This module allows users to login through an OpenID Connect provider using the authorization code flow or implicit flow.

Note the implicit flow is not recommended because it exposes access tokens to the browser and in http logs.

auto_awesome What this module does

AI-generated from the code · Odoo 19.0

Lets users sign in to Odoo with an OpenID Connect provider (such as Azure AD or Keycloak) instead of a local password, using either the authorization code flow or the implicit flow.

This module extends the existing OAuth login feature so that Odoo can act as a client of an OpenID Connect identity provider. Administrators configure providers on the same screen as before, where new fields appear: the authentication flow, a token mapping, a client secret, a token URL, a JWKS URL and a PKCE code verifier.

  • Three flows are available: plain OAuth2, OpenID Connect authorization code flow, and OpenID Connect implicit flow (marked as not recommended).
  • The token mapping lets you translate the names used by the provider into the names Odoo expects, for example mapping the standard sub claim to user_id.
  • The module ships two disabled Azure AD provider templates (multitenant and single tenant) and a demo Keycloak provider.

When a user clicks the provider button on the login page, the module builds the authorization link, adds a nonce and a PKCE code challenge, and requests the right response type. After the provider responds, Odoo exchanges the code for tokens when the authorization code flow is used, validates the identity token against the provider's public keys, maps the claims, and signs the user in. If no access token, no identity token, or no user identifier is found, access is denied. The module touches auth.oauth.provider and res.users.

Depends on

auth_oauth

Required by other modules

auth_oidc_environment
Models and fields (2)
  • res.users · extends an existing model
  • auth.oauth.provider · extends an existing modelflow (Auth Flow), jwks_uri (JWKS URL), token_map, client_secret, code_verifier, token_endpoint (Token URL), validation_endpoint

Text generated by AI (DeepSeek) from reading the Odoo 19.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 8 confirmed, 1 with no information of 9 versions.

Sources · Odoo 16.0

Confirmed on 2026-11-03 in branch 16.0 of OCA/server-auth.

terminal Installation and usage

OCA documentation · Odoo 19.0

Installation

Source · Odoo 19.0

This module depends on the python-jose library, not to be confused with jose which is also available on PyPI.

Configuration

Source · Odoo 19.0

Setup for Microsoft Azure

Example configuration with OpenID Connect authorization code flow.

  • configure a new web application in Azure with OpenID and code flow (see

the provider documentation))

  • in this application the redirect url must be be "\/auth_oauth/signin" and of course this URL should be reachable

from Azure

  • create a new authentication provider in Odoo with the following

parameters (see the portal documentation for more information):

Single tenant provider limits the access to user of your tenant, while Multitenants allow access for all AzureAD users, so user of foreign companies can use their AzureAD login without an guest account.

  • Provider Name: Azure AD Single Tenant
  • Client ID: Application (client) id
  • Client Secret: Client secret
  • Allowed: yes

or

  • Provider Name: Azure AD Multitenant
  • Client ID: Application (client) id
  • Client Secret: Client secret
  • Allowed: yes
  • replace {tenant_id} in urls with your Azure tenant id

Setup for Keycloak

Example configuration with OpenID Connect authorization code flow.

In Keycloak:

  • configure a new Client
  • make sure Authorization Code Flow is

Enabled.

  • configure the client Access Type as "confidential" and take

note of the client secret in the Credentials tab

  • configure the

redirect url to be "\/auth_oauth/signin"

In Odoo, create a new Oauth Provider with the following parameters:

  • Provider name: Keycloak (or any name you like that identify your keycloak provider)
  • Auth Flow: OpenID Connect (authorization code flow)
  • Client ID: the same Client ID you entered when configuring the client in Keycloak
  • Client Secret: found in keycloak on the client Credentials tab
  • Allowed: yes
  • Body: the link text to appear on the login page, such as Login with Keycloak
  • Scope: openid email
  • Authentication URL: The "authorization_endpoint" URL found in the OpenID Endpoint Configuration of your Keycloak realm
  • Token URL: The "token_endpoint" URL found in the OpenID Endpoint Configuration of your Keycloak realm
  • JWKS URL: The "jwks_uri" URL found in the OpenID Endpoint Configuration of your Keycloak realm

Usage

Source · Odoo 19.0

On the login page, click on the authentication provider you configured.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.