Overslaan naar inhoud
Je moet geregistreerd zijn om te kunnen communiceren met de community.
Alle posts Personen Badges
Labels (Bekijk alle)
odoo accounting v14 pos v15
Over dit forum
Deze vraag is gerapporteerd
loginpageOdoo.shSSO
4 Antwoorden
210 Weergaven
Avatar
Rutger Hofste

We have a customer with strict security requirements who wants to enforce authentication only via Azure Entra ID (SSO).

Currently, SSO is enabled and works as expected, but it’s still possible for users to log in using their Odoo username and password. This is not acceptable for their compliance needs, they want SSO to be the only authentication method.

Has anyone implemented a setup where Odoo completely disables local authentication (i.e., direct username/password login), allowing only Azure Entra ID-based SSO access?

We’re looking for the cleanest and most secure approach, ideally something that doesn’t break admin access or automated processes.

Any insights or best practices would be greatly appreciated!


Avatar
Annuleer
Avatar
Latus GmbH
Beste antwoord

Hi Rutger, 

Changing the login form is possible, but actually an incomplete approach if you think of security. 
This is because the server will still allow requests for logging in with user and password. 

We are currently building a module to do this correctly and also decide per user how they are allowed to login. 

Let's connect (I've sent you a request on LinkedIn) so you can have a look at the module once finished. 
Thanks and best regards

Joep

Avatar
Annuleer
Avatar
Anthony ROBLES
Beste antwoord

Thanks for this post, we also have the exact same requirement, so that our security can only be ensured by our Azure Entra ID authentification with an active MFA.

Avatar
Annuleer
Avatar
Rutger Hofste
Auteur Beste antwoord

Thanks Jainesh, this would indeed improve the user experience quite a bit. For our client user experience is a nice to have though whereas security is a must have. By simply changing the layout of the form, the methods remain active, don't they?

Avatar
Annuleer
Avatar
Jainesh Shah(Aktiv Software)
Beste antwoord
Hello Rutger Hofste,

If you want to disable the standard Odoo username/password login and allow access only through Azure Entra ID (SSO), you can accomplish this by inheriting the web.login template and removing the local login elements.
Odoo does not provide a built-in setting to “turn off” password login, but you can fully block it by overriding the login template.

In your inherited template (web.login), hide/remove the following:
Email input block
The <div> that contains the email label and login input field.
Password input block
The <div> that contains the password label and password input field.
Log In button
The standard submit button used for local authentication.
Log In as Superuser (debug mode)
The secondary login button that appears when debug mode is active.
Once these elements are removed from the overridden web.login template, the local login form disappears completely, and only your OAuth / Azure Entra ID SSO buttons remain on the login page.

Result:
Users cannot enter an email or password.
Standard Odoo authentication becomes impossible.
Only SSO remains available.

Matches strict compliance/security requirements.

Avatar
Annuleer
Rutger Hofste
Auteur

Thanks Jainesh, this would indeed improve the user experience quite a bit. For our client user experience is a nice to have though whereas security is a must have. By simply changing the layout of the form, the methods remain active, don't they?

Gerelateerde posts Antwoorden Weergaven Activiteit
How to Add a User to Access the Database on Odoo.sh?
Odoo.sh
Avatar
Avatar
1
okt. 25
4025
Odoo.SH Github account ownership transfer, trying to change the repository
Odoo.sh
Avatar
Avatar
Avatar
2
mrt. 25
8062
Odoo.sh sale commission Opgelost
Odoo.sh
Avatar
Avatar
1
aug. 23
2868
Odoo.sh Bad Gateway
Odoo.sh
Avatar
0
nov. 21
3868
How to restore login page
loginpage
Avatar
Avatar
Avatar
3
jan. 20
7442