Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_odoo [2026/09/08 23:00] – [Prerequisites] kainhofer
+++ en:2.0:single_sign_on:oidc_odoo [2026/09/09 00:20] (current) – [Setting up the Client (SP) in Admidio] kainhofer
@@ Line 22: / Line 22: @@
 ===== Quick Overview =====
-Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The client (RP, Odoo in our case) needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. Admidio provides copy buttons in the preferences screen, so this is rather straightforward. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
+Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:
+  - The client (RP, Odoo in our case) needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into Odoo's configuration. Admidio provides copy buttons in the preferences screen, so this is rather straightforward.
+  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
 The concrete steps are:
   * At the **Relying Party (RP)** - Odoo in our case - **install the extension** to support OpenID login.
     * Configure it with Admidio's **endpoint URLs** for authentication, token and userinfo, and enter the EntityID.
-    * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; Since the OpenID Odoo plugin does not support groups mapping, the "groups" scope is not relevant and has no use.
+    * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; Since the OpenID Odoo plugin does not support groups mapping, the "groups" scope is not relevant and has no use).
   * In **Admidio**, **create a new OpenID client**.
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
-    * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it into the Odoo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's configuration page in Odoo.
+    * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it indo DokuWiki's configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's configuration page in Odoo.
+    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error.
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Odoo.
@@ Line 81: / Line 84: @@
   * In addition, Odoo also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the Odoo user's profile data. None of them are required, but they can be mapped, if profile information should be transferred from Admidio to Odoo. If automatic account creation is desired, the email claim must be included.
-{{ :en:2.0:sso:sso_odoo_oidc_05a_configuration_claims.png?direct&300 |}}
 After saving the changes (both in Odoo and Admidio), the apps should should now be set up for single-sign-on in Odoo.