| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:saml_odoo [2025/05/15 23:54] – [TL;DR; - Quick Overview] kainhofer | en:2.0:single_sign_on:saml_odoo [2026/09/05 23:14] (current) – [Caveats and Things to Consider] kainhofer |
|---|
| |
| Throughout the document we will assume you have both Admidio and Odoo already set up properly at https://admidio.local/ and https://odoo.local/. Please modify these URLs to your actual installation. | Throughout the document we will assume you have both Admidio and Odoo already set up properly at https://admidio.local/ and https://odoo.local/. Please modify these URLs to your actual installation. |
| | |
| As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider]] | As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_a_saml_id_provider|follow this guide]]. |
| {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} |
| |
| Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**. | Basically, one needs to enable SAML 2.0 and **choose a unique EntityID**. |
| The page preferences https://admidio.local/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. | |
| | The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. |
| |
| ===== Quick Overview ===== | ===== Quick Overview ===== |
| |
| Setting up a client (SAML "Service Provider" - short SP) to use Admidio's user accounts for logging in consists of two steps. If both the IdP (Admidio in our case) and the SP (Odoo in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this situation is not as bad, either. | Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (Odoo in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this case is also straightforward. |
| |
| * At the **Service Provider (SP)** - Odoo in our case - **install the extension** to support SAML login. | * At the **Service Provider (SP)** - Odoo in our case - **install the extension** to support SAML login. |
| * Choose whether sent messages **should be signed and/or encrypted** (these features require an additional private key and certificate for the SP!), and whether received messages are checked for signatures or encryption is expected. | * Choose whether sent messages **should be signed and/or encrypted** (these features require an additional private key and certificate for the SP!), and whether received messages are checked for signatures or encryption is expected. |
| * In **Admidio**, **create a new SAML client**. If the SP provides a **metadata URL**, paste it and let Admidio automatically load the configuration from the SP. One can also manually paste these settings. | * In **Admidio**, **create a new SAML client**. If the SP provides a **metadata URL**, paste it and let Admidio automatically load the configuration from the SP. One can also manually paste these settings. |
| * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use) | * Choose an easily understood **label for the client** (only used in Admidio's list of clients as visual identifier, but has no technical use) |
| * Enter the **ClientID from the SP**, as well as the ACS URL and the SLO response URL. These values must be provided by the client. | * Enter the **ClientID from the SP**, as well as the ACS URL and the SLO response URL. These values must be provided by the client. |
| * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used. | * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used. |
| {{ :en:2.0:sso:sso_saml_02-03a_nc_saml_keysetup1.png?direct&400 |}} | {{ :en:2.0:sso:sso_saml_02-03a_nc_saml_keysetup1.png?direct&400 |}} |
| |
| After downloading the .p12 file, Applications like [[https://keystore-explorer.org/|KeyStore Explorer]] can be used to read the private key and copy the private key and the certificate in PEM format into a file and upload it into Odoo's SAML configuration. As signature algorithm choose either SHA1 or the more modern SHA256 | After downloading the .p12 file, Applications like [[https://keystore-explorer.org/|KeyStore Explorer]] can be used to read the private key and copy the private key and the certificate in PEM format into a file and upload them into Odoo's SAML configuration. As signature algorithm choose either SHA1 or the more modern SHA256. |
| |
| {{:en:2.0:sso:sso_saml_02-03b_nc_saml_keystoreexplorer1.png?direct&400|}}{{:en:2.0:sso:sso_saml_02-03c_nc_saml_keystoreexplorer2.png?direct&400|}} | {{:en:2.0:sso:sso_saml_02-03b_nc_saml_keystoreexplorer1.png?direct&400|}}{{:en:2.0:sso:sso_saml_02-03c_nc_saml_keystoreexplorer2.png?direct&400|}} |
| |
| |
| <WRAP center round todo 60%> | |
| todo box | |
| </WRAP> | |
| |
| |
| |
| |
| If the basic settings are valid, the Odoo plugin provides a link to the client (SP) metadata XML file right above the certificat upload field. Copy that URL, so it can be pasted into Admidio for auto-configuration of the SAML access (right-click on the link and copy the link location to the clipboard). | If the basic settings are valid and saved, the Odoo plugin provides a link to the client (SP) metadata XML file right above the certificat upload field. Copy that URL, so it can be pasted into Admidio for auto-configuration of the SAML access (right-click on the link and copy the link location to the clipboard). |
| |
| {{ :en:2.0:sso:sso_saml_odoo_05_odoo_setup_samlprovider_crypto.png?direct |}} | |
| |
| |
| |
| * Odoo does NOT automatically create a new user account if a successful login from an unknown Admidio account occurs. Instead, one first has to create a new user (or connect an existing user) and connect that user with the proper Admidio user account name. In Admidio's SAML client config, you can select whether to use the numeric user ID, the login name or the email as "User ID field". Whatever you choose determines which value must be entered in Odoo's user connection field. | * Odoo does NOT automatically create a new user account if a successful login from an unknown Admidio account occurs. Instead, one first has to create a new user (or connect an existing user) and connect that user with the proper Admidio user account name. In Admidio's SAML client config, you can select whether to use the numeric user ID, the login name or the email as "User ID field". Whatever you choose determines which value must be entered in Odoo's user connection field. |
| | * Odoo does not support SAML Single-Log-Out, so logging out from Odoo will not log the user out from Admidio or other SAML or OIDC clients. |
| | * Odoo's SAML User IDs are case-sensitive. If your Admidio username is "Member", you can log into Admidio using "member", but in Odoo's SAML user ID you must use the original "Member". |
| * To install the SAML plugin, odoo needs the "pysaml2" library installed first. It can for example be installed from the shell with <code>php3 install pysaml2</code> | * To install the SAML plugin, odoo needs the "pysaml2" library installed first. It can for example be installed from the shell with <code>php3 install pysaml2</code> |
| * If odoo is behind a reverse proxy (e.g. Nginx Proxy Manager), correct proxy settings both in Odoo and the proxy itself is vital to make sure that the SAML endpoints in the metadata file and the actually called endpoints actually use https. Otherwise, login will fail without a helpful error message. | * If odoo is behind a reverse proxy (e.g. Nginx Proxy Manager), correct proxy settings both in Odoo and the proxy itself is vital to make sure that the SAML endpoints in the metadata file and the actually called endpoints actually use https. Otherwise, login will fail without a helpful error message. |
| * In `odoo.conf` set <code>proxy_mode = 1</code> | * In `odoo.conf` set <code>proxy_mode = 1</code> |
| * Make sure the reverse proxy sends all proper proxy headers, including X-FORWARDED-HOST, which is used by odoo to detect a reverse proxy setup. Nginx Proxy Manager by default does not send this header. It is also not easily possible to add this header in the "Advanced" tab of the Proxy Host in NPM. Instead, one has to add Custom Location for "/" and set the X-Forwarded-Host header there via <code>proxy_set_header X-Forwarded-Host $host;</code> You need to duplicate the forwarding host information from the main host:{{ :en:2.0:sso:sso_saml_odoo_12_npm_x-forwarded-host.png?direct&400 |}} | * Make sure the reverse proxy sends all proper proxy headers, including X-FORWARDED-HOST, which is used by odoo to detect a reverse proxy setup. Nginx Proxy Manager by default does not send this header. It is also not easily possible to add this header in the "Advanced" tab of the Proxy Host in NPM. Instead, one has to add Custom Location for "/" and set the X-Forwarded-Host header there via <code>proxy_set_header X-Forwarded-Host $host;</code> You need to duplicate the forwarding host information from the main host:{{ :en:2.0:sso:sso_saml_odoo_12_npm_x-forwarded-host.png?direct&400 |}} |
