Skip to main content

Dolibarr

This guide explains how to connect Dolibarr (open-source ERP/CRM) to VaultysHub using its built-in OpenID Connect module, which utilizes the authorization code flow.

Prerequisites​

  • Dolibarr with the OpenID Connect module (tested with Dolibarr 24), served over HTTPS (for example https://erp.example.com)
  • Administrator access to Dolibarr, and to the conf/conf.php file
  • Administrator access to VaultysHub

Configuration in VaultysHub​

  1. Applications → Add: name Dolibarr, URL https://erp.example.com/
  2. Type OIDC, then:
    • Redirect URI: https://erp.example.com/core/modules/openid_connect/callback.php
    • Allowed scopes: openid, email, profile
    • Subject identifier (sub): Email address
    • Require PKCE: disabled (Dolibarr does not send it)
  3. Note the Client ID ([appid]) and the Client secret, then assign the application to the relevant users.

Dolibarr sends the secret in the request body (client_secret_post), a method that VaultysHub accepts.

Configuration in Dolibarr​

1. Enable the authentication method​

In conf/conf.php:

// OpenID Connect first, local accounts still possible (admin)
$dolibarr_main_authentication = 'openid_connect,dolibarr';
// create the Dolibarr account on first login (optional)
$dolibarr_main_authentication_autocreateuser = 1;

2. Configure the module​

Home → Configuration → Modules → OpenID Connect (configuration tab):

ParameterValue
Client ID / Client secretthose of the VaultysHub application
Authorization URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/auth
Token URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/token
Userinfo URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo
Scopesopenid email profile
Login claimemail
First name / last name / email claimsgiven_name / family_name / email

These parameters correspond to the constants MAIN_AUTHENTICATION_OIDC_* (…_ON, …_CLIENT_ID, …_CLIENT_SECRET, …_AUTHORIZE_URL, …_TOKEN_URL, …_USERINFO_URL, …_SCOPES, …_LOGIN_CLAIM), which can also be defined in Configuration → Other settings.

For accounts created automatically, MAIN_AUTHENTICATION_OIDC_DEFAULT_CREATOR indicates the creator user and MAIN_AUTHENTICATION_OIDC_DEFAULT_GROUP a group to assign them: VaultysHub does not transmit groups.

Test​

The login page displays Login with OpenID Connect: validate with your VaultysID, you return logged in. The local form remains available for the administrator.

Troubleshooting​

  • Nothing happens, or "URL not allowed": Dolibarr only calls VaultysHub over HTTPS.
  • "Failed to connect to …" even though the server successfully connects to VaultysHub: Dolibarr resolves names with dns_get_record(), which queries directly the DNS and ignores /etc/hosts. If VaultysHub is declared in /etc/hosts (internal network, containers), set the constant MAIN_DISABLE_DNS_GET_RECORD_FOR_IP_RESOLUTION to 1.
  • The account is created without rights: assign them in Users & Groups, or via MAIN_AUTHENTICATION_OIDC_DEFAULT_GROUP.

Resources​