Let users log into Odoo via an SAML2 identity provider.
This module allows to deport the management of users and passwords in an external authentication system to provide SSO functionality (Single Sign On) between Odoo and other applications of your ecosystem.
Benefits:
- Reducing the time spent typing different passwords for different accounts.
- Reducing the time spent in IT support for password oversights.
- Centralizing authentication systems.
- Securing all input levels / exit / access to multiple systems without prompting users.
- The centralization of access control information for compliance testing to different standards.
auto_awesome What this module does
AI-generated from the code · Odoo 19.0Lets users sign in to Odoo through an external SAML2 identity provider (single sign-on), and lets administrators configure providers, user matching and automatic user creation from the Odoo interface.
This module adds single sign-on with an external SAML2 identity provider to Odoo. Administrators configure one or more providers under a new "SAML Providers" menu (under Users), where they enter the provider name, identity provider metadata (or a metadata URL that can be refreshed with a button), the Odoo certificate and private key, the matching attribute used to find the Odoo user, and the signature options.
On the login page, each active provider appears as an extra login button (with a configurable label and icon). A provider can be set to redirect automatically, so users are sent straight to the identity provider without seeing the Odoo login form.
Business rules and automatic behaviour: - Users are matched to Odoo accounts by the configured identity provider attribute; a mapping table can copy extra attributes from the identity provider response into Odoo user fields. - A provider can be allowed to create users automatically when no match is found, optionally using a template user, and can reactivate a deactivated matching user. - A setting controls whether SAML users may also keep an Odoo password; when it is off, passwords are removed from SAML users (except the superuser and admin) and setting one raises an error. - Outstanding authentication requests are stored, and metadata is served at a dedicated URL for the identity provider.
It touches res.users, res.config.settings, ir.config_parameter and the login screens.
Depends on
Required by other modules
Menus it adds
Models and fields (7)
- res.users · extends an existing modelsaml_ids
- res.users.saml · new modeluser_id, saml_uid (SAML User ID), saml_provider_id (SAML Provider), saml_access_token (Current SAML token for this user)
- auth_saml.request · new modelsaml_request_id (Current Request ID), saml_provider_id (SAML Provider that issued the token)
- auth.saml.provider · new modelbody (Login button label), name (Provider Name), active, sig_alg (Signature Algorithm), sequence, css_class (Button Icon CSS class), entity_id (Entity ID), sp_baseurl (Override Base URL), create_user, autoredirect (Automatic Redirection), idp_metadata (Identity Provider Metadata), sign_metadata, sp_pem_public (Odoo Public Certificate), sp_pem_private (Odoo Private Key), sp_metadata_url (Metadata URL), idp_metadata_url (Identity Provider Metadata URL), matching_attribute (Identity Provider matching attribute), want_response_signed, attribute_mapping_ids (Attribute Mapping), authn_requests_signed, create_user_reactivate (Reactivate when Creating Users), logout_requests_signed, sp_pem_public_filename (Odoo Public Certificate File Name), want_assertions_signed, create_user_template_id, sp_pem_private_filename (Odoo Private Key File Name), sign_authenticate_requests, matching_attribute_to_lower (Lowercase IDP Matching Attribute), want_assertions_or_response_signed
- ir.config_parameter · extends an existing model
- res.config.settings · extends an existing modelallow_saml_uid_and_internal_password (Allow SAML users to possess an Odoo password (warning: decreases security))
- auth.saml.attribute.mapping · new modelfield_name (Odoo Field), provider_id, attribute_name (IDP Response Attribute)
Text generated by AI (DeepSeek) from reading the Odoo 19.0 code on GitHub; it may contain mistakes, so check the code before deciding. The module is very large and only part of the code was read. View the code on GitHub
Availability by version
Reviewed: 2026-11-03Confirmation status: 8 confirmed, 1 with no information of 9 versions.
Sources · Odoo 17.0
Confirmed on 2026-11-03 in branch 17.0 of OCA/server-auth.
terminal Installation and usage
OCA documentation · Odoo 19.0Installation
Source · Odoo 19.0This addon requires the python module pysaml2.
pysaml2 requires the binary xmlsec1 (on Debian or Ubuntu you can install it with apt-get install xmlsec1)
Configuration
Source · Odoo 19.0To use this module, you need an IDP server, properly set up.
- Configure the module according to your IdP’s instructions (Settings \> Users & Companies \> SAML Providers).
- Pre-create your users and set the SAML information against the user, or use the module ability to create users as they log in.
By default, the module let users have both a password and SAML ids. To increase security, disable passwords by using the option in Settings. Note that the admin account can still have a password, even if the option is activated. Setting the option immediately remove all password from users with a configured SAML ids.
If all the users have a SAML id in a single provider, you can set automatic redirection in the provider settings. The autoredirection will only be done on the active provider with the highest priority. It is still possible to access the login without redirection by using the query parameter disable_autoredirect, as in https://example.com/web/login?disable_autoredirect= The login is also displayed if there is an error with SAML login, in order to display any error message.
If you are using Office365 as identity provider, set up the federation metadata document rather than the document itself. This will allow the module to refresh the document when needed.
Usage
Source · Odoo 19.0Users can login with the configured SAML IdP with buttons added in the login screen.
Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.
Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.