Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

Link zu dieser Vergleichsansicht

Nächste Überarbeitung		 Vorhergehende Überarbeitung
en:2.0:single_sign_on:oidc_odoo [2025/05/16 15:39] – created kainhoferen:2.0:single_sign_on:oidc_odoo [2026/09/09 00:20] (aktuell) – [Setting up the Client (SP) in Admidio] kainhofer
Zeile 10: Zeile 10:
  
 Throughout the document we will assume you have both Admidio and Odoo already set up properly at https://admidio.local/ and https://odoo.local/. Please modify these URLs to your actual installation. Throughout the document we will assume you have both Admidio and Odoo already set up properly at https://admidio.local/ and https://odoo.local/. Please modify these URLs to your actual installation.
-  + 
-As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to Odoo. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_an_oidc_id_provider]]+As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to any particular client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_an_oidc_id_provider|folow this guide]]: 
 {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}} {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}}
  
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**. + 
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.+Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL. 
 + 
 +The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings for clients that do not support auto-configuration via metadata.
  
 ===== Quick Overview ===== ===== Quick Overview =====
  
-Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The client (RP, Odoo in our case) needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. Admidio provides copy buttons in the preferences screen, so this is rather straightforward. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.+Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:  
 +  - The client (RP, Odoo in our case) needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into Odoo's configuration. Admidio provides copy buttons in the preferences screen, so this is rather straightforward.   
 +  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
  
 The concrete steps are: The concrete steps are:
   * At the **Relying Party (RP)** - Odoo in our case - **install the extension** to support OpenID login.   * At the **Relying Party (RP)** - Odoo in our case - **install the extension** to support OpenID login.
     * Configure it with Admidio's **endpoint URLs** for authentication, token and userinfo, and enter the EntityID.      * Configure it with Admidio's **endpoint URLs** for authentication, token and userinfo, and enter the EntityID. 
-    * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; Since the OpenID Odoo plugin does not support groups mapping, the "groups" scope is not relevant and has no use.+    * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; Since the OpenID Odoo plugin does not support groups mapping, the "groups" scope is not relevant and has no use).
   * In **Admidio**, **create a new OpenID client**.    * In **Admidio**, **create a new OpenID client**. 
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)     * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
-    * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it into the Odoo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's configuration page in Odoo.+    * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it indo DokuWiki's configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's configuration page in Odoo. 
 +    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Odoo.      * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Odoo. 
  
Zeile 78: Zeile 84:
  
   * In addition, Odoo also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the Odoo user's profile data. None of them are required, but they can be mapped, if profile information should be transferred from Admidio to Odoo. If automatic account creation is desired, the email claim must be included.   * In addition, Odoo also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the Odoo user's profile data. None of them are required, but they can be mapped, if profile information should be transferred from Admidio to Odoo. If automatic account creation is desired, the email claim must be included.
-{{ :en:2.0:sso:sso_odoo_oidc_05a_configuration_claims.png?direct&300 |}} 
  
 After saving the changes (both in Odoo and Admidio), the apps should should now be set up for single-sign-on in Odoo. After saving the changes (both in Odoo and Admidio), the apps should should now be set up for single-sign-on in Odoo.
  • en/2.0/single_sign_on/oidc_odoo.1747402775.txt.gz
  • Zuletzt geändert: 2025/05/16 15:39
  • von kainhofer